From 4b26e9dc1aef6942de354727af75d61c226c5429 Mon Sep 17 00:00:00 2001 From: "Kyle D. McCormick" Date: Tue, 16 Apr 2024 16:30:10 -0400 Subject: [PATCH 1/5] build: replace wget->curl, so make upgrade works in tutor tutor's containers don't have wget installed, and curl -L works just as well and is installed into basically everything --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 0bb53d1119f4..b459e9424daa 100644 --- a/Makefile +++ b/Makefile @@ -130,7 +130,7 @@ endef COMMON_CONSTRAINTS_TXT=requirements/common_constraints.txt .PHONY: $(COMMON_CONSTRAINTS_TXT) $(COMMON_CONSTRAINTS_TXT): - wget -O "$(@)" https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt + curl -L https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt > "$(@)" printf "$(COMMON_CONSTRAINTS_TEMP_COMMENT)" | cat - $(@) > temp && mv temp $(@) compile-requirements: export CUSTOM_COMPILE_COMMAND=make upgrade From 39f75f217cc0745a9586114015673b194c3ecde0 Mon Sep 17 00:00:00 2001 From: "Kyle D. McCormick" Date: Tue, 16 Apr 2024 16:05:12 -0400 Subject: [PATCH 2/5] refactor: remove requirements/edx-sandbox/shared.[in,txt] These files were used to assist the Python 3.5 -> 3.8 upgrade, but they are no longer needed nor referened anywhere. They haven't been updated for years. --- requirements/edx-sandbox/shared.in | 14 ------------ requirements/edx-sandbox/shared.txt | 34 ----------------------------- 2 files changed, 48 deletions(-) delete mode 100644 requirements/edx-sandbox/shared.in delete mode 100644 requirements/edx-sandbox/shared.txt diff --git a/requirements/edx-sandbox/shared.in b/requirements/edx-sandbox/shared.in deleted file mode 100644 index 5bcfd9ce712b..000000000000 --- a/requirements/edx-sandbox/shared.in +++ /dev/null @@ -1,14 +0,0 @@ -# Core dependencies shared between Python sandboxes for secured execution and edx-platform. -# -# DON'T JUST ADD NEW DEPENDENCIES!!! -# -# If you open a pull request that adds a new dependency, you should: -# * verify that the dependency has a license compatible with AGPLv3 -# * confirm that it has no system requirements beyond what we already install -# * run "make upgrade" to update the detailed requirements files - --c ../constraints.txt - -cryptography # Implementations of assorted cryptography algorithms -lxml # XML parser -nltk # Natural language processing; used by the chem package diff --git a/requirements/edx-sandbox/shared.txt b/requirements/edx-sandbox/shared.txt deleted file mode 100644 index 70794cbe57bf..000000000000 --- a/requirements/edx-sandbox/shared.txt +++ /dev/null @@ -1,34 +0,0 @@ -# -# This file is autogenerated by pip-compile -# To update, run: -# -# make upgrade -# -cffi==1.14.5 - # via cryptography -click==7.1.2 - # via - # -c requirements/edx-sandbox/../constraints.txt - # nltk -cryptography==3.2.1 - # via - # -c requirements/edx-sandbox/../constraints.txt - # -r requirements/edx-sandbox/shared.in -joblib==0.14.1 - # via - # -c requirements/edx-sandbox/../constraints.txt - # nltk -lxml==4.5.0 - # via - # -c requirements/edx-sandbox/../constraints.txt - # -r requirements/edx-sandbox/shared.in -nltk==3.6.2 - # via -r requirements/edx-sandbox/shared.in -pycparser==2.20 - # via cffi -regex==2021.4.4 - # via nltk -six==1.16.0 - # via cryptography -tqdm==4.61.0 - # via nltk From e2734e36cca4cc454dd775fe25a7d824e18524de Mon Sep 17 00:00:00 2001 From: "Kyle D. McCormick" Date: Tue, 16 Apr 2024 16:06:59 -0400 Subject: [PATCH 3/5] feat!: expose per-release edx-sandbox dependency pins See requirements/edx-sandbox/README.rst for more info BREAKING CHANGE: edx-sandbox/py38.txt will not longer be updated. Please install from either edx-sandbox/base.txt or edx-sandbox/releases/*.txt instead. --- Makefile | 2 +- requirements/edx-sandbox/README.rst | 59 +++++++++++++++++++ requirements/edx-sandbox/{py38.in => base.in} | 0 .../edx-sandbox/{py38.txt => base.txt} | 24 ++++---- requirements/edx-sandbox/releases/.gitignore | 0 5 files changed, 72 insertions(+), 13 deletions(-) create mode 100644 requirements/edx-sandbox/README.rst rename requirements/edx-sandbox/{py38.in => base.in} (100%) rename requirements/edx-sandbox/{py38.txt => base.txt} (74%) create mode 100644 requirements/edx-sandbox/releases/.gitignore diff --git a/Makefile b/Makefile index b459e9424daa..6fc019290088 100644 --- a/Makefile +++ b/Makefile @@ -110,7 +110,7 @@ shell: ## launch a bash shell in a Docker container with all edx-platform depend REQ_FILES = \ requirements/edx/coverage \ requirements/edx/paver \ - requirements/edx-sandbox/py38 \ + requirements/edx-sandbox/base \ requirements/edx/base \ requirements/edx/doc \ requirements/edx/testing \ diff --git a/requirements/edx-sandbox/README.rst b/requirements/edx-sandbox/README.rst new file mode 100644 index 000000000000..6129aa865b31 --- /dev/null +++ b/requirements/edx-sandbox/README.rst @@ -0,0 +1,59 @@ +edx-sandbox: a Python environment for sandboxed execution with CodeJail +####################################################################### + +The requirements in this directory describe a Python environment separate from +the general edx-platform environment. When correctly configured with +`CodeJail `_, edx-platform can use +it to execute untrusted code, particularly instructor-authored Python code +within ``