python3: upgrade to release 3.5.9

Fixes CVE-2019-9948 CVE-2019-9740 CVE-2019-10160 CVE-2019-16056
and expat CVE-2019-15903.

python-3.3.5-pyexpat-symbols.patch.1 fails to apply, and it's a
mystery why --with-system-expat is used everywhere but on MacOSX,
where 292af048ace2d4b455b2da3a22c784cb05db1d09 disabled it for no
obvious reason, so try to remove the special case and get rid of the
patch.

Change-Id: I5ba4532eb6e7c2fb90daba95d132dcc7c9013d96
Reviewed-on: https://gerrit.libreoffice.org/83117
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@cib.de>
(cherry picked from commit b0930d56130fdddfe65e92b081a8afad77974076)
Reviewed-on: https://gerrit.libreoffice.org/83187

3 files changed, 2 insertions, 33 deletions

diff --git a/external/python3/ExternalProject_python3.mk b/external/python3/ExternalProject_python3.mk
index dafeb1ca5ae8..b03b09a83bc4 100644
--- a/external/python3/ExternalProject_python3.mk
+++ b/external/python3/ExternalProject_python3.mk
@@ -44,9 +44,7 @@ $(call gb_ExternalProject_get_state_target,python3,build) :
 
 else
 
-# this was added in 2004, hopefully is obsolete now (and why only intel anyway)? $(if $(filter SOLARIS-INTEL,$(OS)$(CPUNAME)),--disable-ipv6)
-
-# --with-system-expat: this should find the one in the solver (or system)
+# --with-system-expat: this should find the one in the workdir (or system)
 
 # create a symlink "LO_lib" because the .so are in a directory with platform
 # specific name like build/lib.linux-x86_64-3.3
@@ -68,7 +66,7 @@ $(call gb_ExternalProject_get_state_target,python3,build) :
 		$(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)) \
 		$(if $(ENABLE_VALGRIND),--with-valgrind) \
 		--prefix=/python-inst \
-		$(if $(filter MACOSX,$(OS)),,--with-system-expat) \
+		--with-system-expat \
 		$(if $(filter AIX,$(OS)), \
 			--disable-ipv6 --with-threads OPT="-g0 -fwrapv -O3 -Wall", \
 			$(if $(gb_Module_CURRENTMODULE_DEBUG_ENABLED), \
diff --git a/external/python3/UnpackedTarball_python3.mk b/external/python3/UnpackedTarball_python3.mk
index 09bd9fa2edf6..29d417e57833 100644
--- a/external/python3/UnpackedTarball_python3.mk
+++ b/external/python3/UnpackedTarball_python3.mk
@@ -23,7 +23,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,python3,\
 	external/python3/python-3.5.4-msvc-disable.patch.1 \
 	external/python3/python-3.3.0-pythreadstate.patch.1 \
 	external/python3/python-3.3.0-clang.patch.1 \
-	external/python3/python-3.3.5-pyexpat-symbols.patch.1 \
 	external/python3/ubsan.patch.0 \
 	external/python3/python-3.5.tweak.strip.soabi.patch \
 	external/python3/darwin.patch.0 \
diff --git a/external/python3/python-3.3.5-pyexpat-symbols.patch.1 b/external/python3/python-3.3.5-pyexpat-symbols.patch.1
deleted file mode 100644
index c04c78cf36e7..000000000000
--- a/external/python3/python-3.3.5-pyexpat-symbols.patch.1
+++ /dev/null
@@ -1,28 +0,0 @@
-HACK: Fix build breakage on MacOS:
-
-*** WARNING: renaming "pyexpat" since importing it failed: dlopen(build/lib.macosx-10.6-i386-3.3/pyexpat.so, 2): Symbol not found: _XML_ErrorString
-
-This reverts c242a8f30806 from the python hg repo:
-
-restore namespacing of pyexpat symbols (closes #19186)
-
-
-See http://bugs.python.org/issue19186#msg214069
-
-The recommendation to include Modules/inc at first broke the Linux build...
-
-So do it this way, as it was before. Needs some realignment later.
-
---- python3/Modules/expat/expat_external.h
-+++ python3/Modules/expat/expat_external.h
-@@ -7,10 +7,6 @@
-
- /* External API definitions */
-
--/* Namespace external symbols to allow multiple libexpat version to
--   co-exist. */
--#include "pyexpatns.h"
--
- #if defined(_MSC_EXTENSIONS) && !defined(__BEOS__) && !defined(__CYGWIN__)
- #define XML_USE_MSC_EXTENSIONS 1
- #endif