SRU: Update Python interpreter to 3.6.9 and 3.7.5

I am not sure if this is the place to report this, but I cannot think of a better one to attract Mathias' attention, sorry.

Four python3.6 packages (and likely also python3.7 and python3.8) currently available in the ubuntu-toolchain-r PPA have an unmet version dependency on the 'python3' package. After adding the ppa, apt reports certain packages as upgradeable, but they cannot be upgraded:
--------------------------------
# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.3 LTS
Release: 18.04
Codename: bionic
# uname -a
Linux [redacted] 4.15.0-64-generic #73-Ubuntu SMP Thu Sep 12 13:16:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
# apt list --upgradable | grep python

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

libpython3.6/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
libpython3.6-dev/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
libpython3.6-minimal/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
libpython3.6-stdlib/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
python3-distutils/bionic 3.6.9-1~18.04 all [upgradable from: 3.6.8-1~18.04]
python3-gdbm/bionic 3.6.9-1~18.04 amd64 [upgradable from: 3.6.8-1~18.04]
python3-lib2to3/bionic 3.6.9-1~18.04 all [upgradable from: 3.6.8-1~18.04]
python3-tk/bionic 3.6.9-1~18.04 amd64 [upgradable from: 3.6.8-1~18.04]
python3.6/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
python3.6-dev/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
python3.6-minimal/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
python3.6-venv/bionic 3.6.9-1~b1 amd64 [upgradable from: 3.6.8-1~18.04.2]
# apt upgrade --dry-run libpython3.6 libpython3.6-dev libpython3.6-minimal libpython3.6-stdlib python3-distutils python3-gdbm python3-lib2to3 python3-tk python3.6-venv
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 python3-distutils : Depends: python3 (>= 3.6.8-1~) but 3.6.7-1~18.04 is to be installed
 python3-gdbm : Depends: python3 (>= 3.6.8-1~) but 3.6.7-1~18.04 is to be installed
 python3-lib2to3 : Depends: python3 (>= 3.6.8-1~) but 3.6.7-1~18.04 is to be installed
 python3-tk : Depends: python3 (>= 3.6.8-1~) but 3.6.7-1~18.04 is to be installed
E: Broken packages
--------------------------------

'apt show python3 -a' indicates the version 3.6.7-1~18.04 is from 'http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64', and there is also an original distro version 3.6.5-3 that hails from bionic/main. No other sources are available.

Adding a console log text from above because line wrapping made it unreadable in the body of my comment.

Hello Matthias, or anyone else affected,

Accepted python3.7 into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3.7/3.7.5-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Matthias, or anyone else affected,

Accepted python3-stdlib-extensions into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3-stdlib-extensions/3.7.5-1build1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

This bug was fixed in the package python3.7 - 3.7.5-1ubuntu1

---------------
python3.7 (3.7.5-1ubuntu1) eoan; urgency=medium

  * SRU: LP: #1835738, to build the final 3.7.5 release for eoan,
    just introducing a delta for the SRU process.

python3.7 (3.7.5-1) unstable; urgency=medium

  * Python 3.7.5 release.

 -- Matthias Klose <email address hidden> Tue, 15 Oct 2019 18:15:10 +0200

This bug was fixed in the package python3-stdlib-extensions - 3.7.5-1build1

---------------
python3-stdlib-extensions (3.7.5-1build1) eoan; urgency=medium

  * SRU: LP: #1835738.

python3-stdlib-extensions (3.7.5-1) unstable; urgency=medium

  * Update 3.7 extensions and modules to 3.7.5 release.
  * Update 3.8 extensions and modules to 3.8.0 release.

 -- Matthias Klose <email address hidden> Tue, 15 Oct 2019 18:17:14 +0200

Hello Matthias, or anyone else affected,

Accepted python3-stdlib-extensions into disco-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3-stdlib-extensions/3.7.5-1~19.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-disco to verification-done-disco. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-disco. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted python3-stdlib-extensions (3.7.5-1~19.04) for disco have finished running.
The following regressions have been reported in tests triggered by the package:

thonny/3.1.1-1 (s390x)
python3.8/3.8.0~a3-2 (amd64, arm64, s390x, i386, armhf, ppc64el)
pandas/unknown (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/disco/update_excuses.html#python3-stdlib-extensions

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

This bug was fixed in the package python3-stdlib-extensions - 3.7.5-1build1

---------------
python3-stdlib-extensions (3.7.5-1build1) eoan; urgency=medium

  * SRU: LP: #1835738.

python3-stdlib-extensions (3.7.5-1) unstable; urgency=medium

  * Update 3.7 extensions and modules to 3.7.5 release.
  * Update 3.8 extensions and modules to 3.8.0 release.

 -- Matthias Klose <email address hidden> Tue, 15 Oct 2019 18:17:14 +0200

This bug was fixed in the package python3-stdlib-extensions - 3.7.5-1~19.04

---------------
python3-stdlib-extensions (3.7.5-1~19.04) disco-proposed; urgency=medium

  * SRU: LP: #1835737. Backport the final Python 3.8.0 release.
  * Also update the 3.7 modules to 3.7.5.

python3-stdlib-extensions (3.7.5-1ubuntu1) eoan; urgency=medium

  * SRU: LP: #1835738, to build the final 3.7.5 release for eoan,
    just introducing a delta for the SRU process.

python3-stdlib-extensions (3.7.5-1) unstable; urgency=medium

  * Update 3.7 extensions and modules to 3.7.5 release.
  * Update 3.8 extensions and modules to 3.8.0 release.

python3-stdlib-extensions (3.7.5~rc1-1) unstable; urgency=medium

  * Update 3.7 extensions and modules to 3.7.5 release candidate 1.
  * Update 3.8 extensions and modules to 3.8.0 release candidate 1.
  * Bump standards version.

python3-stdlib-extensions (3.7.4-3) unstable; urgency=medium

  * Don't encode the MACHDEP into the _sysconfigdata file name.
  * Tighten build dependency on python3.8.

python3-stdlib-extensions (3.7.4-1) unstable; urgency=medium

  * Update 3.7 extensions and modules to the 3.7.4 release.
  * Silent some lintian warnings.
  * Bump standards version.

python3-stdlib-extensions (3.7.4~rc2-1) unstable; urgency=medium

  * Update 3.7 extensions and modules to 3.7.4 release candidate 2.
  * Add 3.8 extensions and modules for 3.8.0~b2.
  * Refresh patches.

 -- Matthias Klose <email address hidden> Tue, 15 Oct 2019 18:33:22 +0200

Hello Matthias, or anyone else affected,

Accepted python3.7 into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3.7/3.7.5-2~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Matthias, or anyone else affected,

Accepted python3.6 into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3.6/3.6.9-1~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted python3.6 (3.6.9-1~18.04) for bionic have finished running.
The following regressions have been reported in tests triggered by the package:

pybigwig/0.3.2-1ubuntu5 (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/bionic/update_excuses.html#python3.6

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

python3-stdlib-extensions for bionic was updated as part of the python3.8 SRU.

packages successfully built, no autopkg test regressions. And the test rebuild of main was already done before the upload to -proposed.

Hello Matthias, or anyone else affected,

Accepted python3.7 into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3.7/3.7.5-2~19.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted python3.7 (3.7.5-2~19.10) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

libreoffice/1:6.3.3-0ubuntu0.19.10.1 (s390x)
virtualbox/6.0.14-dfsg-1 (amd64)
ros-ros-comm/1.14.3+ds1-5build2 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#python3.7

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

given back tests, the one remaining failing test

  virtualbox/6.0.14-dfsg-1 (amd64)

doesn't look like it is Python specific.

Thanks! I have hinted virtualbox and will no proceed with releasing those to -updates.

This bug was fixed in the package python3.7 - 3.7.5-2~19.10

---------------
python3.7 (3.7.5-2~19.10) eoan-proposed; urgency=medium

  * SRU: LP: #1835738, backport 3.7.5 to 19.10.

 -- Matthias Klose <email address hidden> Wed, 20 Nov 2019 10:21:52 +0100

This bug was fixed in the package python3.7 - 3.7.5-2~18.04

---------------
python3.7 (3.7.5-2~18.04) bionic-proposed; urgency=medium

  * SRU: LP: #1835738, backport 3.7.5 to 18.04.

python3.7 (3.7.5-2) unstable; urgency=medium

  * python3.7-dev: Depend on zlib1g-dev, needed to link as an
    embedded interpreter.

python3.7 (3.7.5-1) unstable; urgency=medium

  * Python 3.7.5 release.

python3.7 (3.7.5~rc1-2) unstable; urgency=medium

  * Apply proposed patch for issue 38368. LP: #1847036. Closes: #941650.

python3.7 (3.7.5~rc1-1) unstable; urgency=medium

  * Python 3.7.5 release candidate 1.
  * Bump standards version.

python3.7 (3.7.4-4) unstable; urgency=medium

  * Update to 20190904 from the 3.7 branch.

python3.7 (3.7.4-3) unstable; urgency=medium

  * Enable pgo/lto builds on arm64. Closes: #934812.
  * Don't propagate lto flags to the _sysconfigdata module. Closes: #934771.
  * d/patches/issue35998.diff: Disable TLS1.3 in the client on all platforms
    rather than just reducing the payload size (Michael Hudson-Doyle).
  * Annote build dependencies used for tests. Closes: #928513.

python3.7 (3.7.4-2) unstable; urgency=medium

  * Bump the platform name for KFreeBSD.

python3.7 (3.7.4-1) unstable; urgency=medium

  * Python 3.7.4 release.

python3.7 (3.7.4~rc2-2) unstable; urgency=medium

  * Bump standards version.

python3.7 (3.7.4~rc2-1) experimental; urgency=medium

  * Python 3.7.4 release candidate 2.

python3.7 (3.7.4~rc1-1) experimental; urgency=medium

  * Python 3.7.4 release candidate 1.

 -- Matthias Klose <email address hidden> Thu, 07 Nov 2019 11:50:52 +0100

This bug was fixed in the package python3.6 - 3.6.9-1~18.04

---------------
python3.6 (3.6.9-1~18.04) bionic-proposed; urgency=medium

  * SRU: LP: #1835738, backport 3.6.9 to 18.04.
  * Python 3.6.9 release.
  * Remove patches applied upstream:
    - CVE-2018-20852.patch
    - CVE-2019-5010.patch
    - CVE-2019-9636.patch
    - CVE-2019-9740.patch
    - CVE-2019-9948.patch
    - CVE-2019-10160-1.patch
    - CVE-2019-10160-2.patch
  * Enable the lto build on arm64.

 -- Matthias Klose <email address hidden> Thu, 07 Nov 2019 11:44:02 +0100

The verification of the Stable Release Update for python3.6 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Is it normal that it took 4 months to bring this security update to 18.04?

it is not a security update, and the security relevant fixes were published in 18.04 LTS before.