commit:     1cdabc307639bd105b7da526dddfef6fdf6f99e6
Author:     Michał Górny <mgorny <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 13 11:27:02 2020 +0000
Commit:     Michał Górny <mgorny <AT> gentoo <DOT> org>
CommitDate: Mon Jul 13 11:28:42 2020 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1cdabc30

package.mask: Last rite mid-profile <pillow-7 revdeps

Bug: https://bugs.gentoo.org/729672
Signed-off-by: Michał Górny <mgorny <AT> gentoo.org>

 profiles/base/package.use.mask |  4 ++++
 profiles/package.mask          | 31 +++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/profiles/base/package.use.mask b/profiles/base/package.use.mask
index b2a4e3c7e01..8b461fdca9c 100644
--- a/profiles/base/package.use.mask
+++ b/profiles/base/package.use.mask
@@ -6,6 +6,10 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Michał Górny <[email protected]> (2020-07-13)
+# Requires vulnerable dev-python/pillow version.
+sci-libs/scipy python_targets_python2_7
+
 # Thomas Deutschmann <[email protected]> (2020-07-09)
 # media-video/pipewire:0/0.3 is currently masked
 www-client/firefox screencast

diff --git a/profiles/package.mask b/profiles/package.mask
index 9c135150911..79727bbb240 100644
--- a/profiles/package.mask
+++ b/profiles/package.mask
@@ -32,6 +32,37 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <[email protected]> (2020-07-13)
+# These packages are mid-profile Python 2-only dependencies
+# of dev-python/pillow.  Since the last Pillow version to support
+# Python 2 contains a number of unresolved vulnerabilities, these
+# packages and old package versions are queued for removal.
+#
+# In more detail:
+# - pyxplot has been last released in 2012
+# - pkpgcounter has been last released in 2007, and has seen only a few
+#   commits since 2009
+# - scipy has removed py2 support in 1.4 (py2 target in the old version
+#   is masked in profiles/base/package.use.mask)
+#
+# This list does not include two high-profile packages:
+# - app-office/scribus whose py3 version is being currently stabilized
+# - media-tv/kodi which has no py3 version at the moment
+#
+# Removal in 30 days.  Bug #729672.
+<media-plugins/mythplugins-31
+net-print/pkpgcounter
+<sci-chemistry/chemex-2018
+sci-libs/scipy-python2
+sci-visualization/pyxplot
+<net-wireless/gnuradio-3.8
+<net-wireless/gr-iio-0.3_p20191219-r1
+<net-wireless/gr-paint-0.0_p20200517
+<net-analyzer/gr-fosphor-0.0_p20200131
+<net-wireless/gr-ieee802154-0.0_p20191006
+<net-wireless/gr-iqbal-0.38.1
+<net-wireless/gr-osmosdr-0.2.0
+
 # Michał Górny <[email protected]> (2020-07-13)
 # Unmaintained.  Last release from 2018, still does not support py3.
 # Removal in 30 days.  Bug #732352.

Reply via email to