From b8467f1c8862b8eaf150c675a232531f55a4b258 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jason=20=E3=83=86=E3=82=A3=E3=83=93=E3=83=84?= Date: Thu, 11 Jun 2009 20:06:34 +0000 Subject: [PATCH 1/7] Initialize branch EL-5 for python-jinja2 --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..42f697a --- /dev/null +++ b/branch @@ -0,0 +1 @@ +EL-5 From 4c42845c02621739b4616c6111ff6434340d196c Mon Sep 17 00:00:00 2001 From: Thomas Moschny Date: Sun, 20 Sep 2009 18:09:21 +0000 Subject: [PATCH 2/7] Update to 2.2.1. --- .cvsignore | 2 +- import.log | 1 + python-jinja2-docs.patch | 12 ------------ python-jinja2.spec | 38 +++++++++++++++++++++----------------- sources | 2 +- 5 files changed, 24 insertions(+), 31 deletions(-) delete mode 100644 python-jinja2-docs.patch diff --git a/.cvsignore b/.cvsignore index 3aac9b6..1146c94 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -Jinja2-2.1.1.tar.gz +Jinja2-2.2.1.tar.gz diff --git a/import.log b/import.log index f55783f..2d38857 100644 --- a/import.log +++ b/import.log @@ -1,3 +1,4 @@ python-jinja2-2_0-2_fc9:HEAD:python-jinja2-2.0-2.fc9.src.rpm:1216886150 python-jinja2-2_1-1_fc10:HEAD:python-jinja2-2.1-1.fc10.src.rpm:1229610786 python-jinja2-2_1_1-1_fc10:HEAD:python-jinja2-2.1.1-1.fc10.src.rpm:1231601194 +python-jinja2-2_2_1-1_fc11:EL-5:python-jinja2-2.2.1-1.fc11.src.rpm:1253470104 diff --git a/python-jinja2-docs.patch b/python-jinja2-docs.patch deleted file mode 100644 index 61310bf..0000000 --- a/python-jinja2-docs.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up Jinja2-2.1/setup.py.orig Jinja2-2.1/setup.py ---- Jinja2-2.1/setup.py.orig 2008-11-23 13:08:17.000000000 +0100 -+++ Jinja2-2.1/setup.py 2008-12-18 15:14:22.000000000 +0100 -@@ -54,7 +54,7 @@ VERSION = '2.1' - - data_files = [] - documentation_path = 'docs/_build/html' --if os.path.exists(documentation_path): -+if os.path.exists(documentation_path) and False: - documentation_files = [] - for fn in os.listdir(documentation_path): - if not fn.startswith('.'): diff --git a/python-jinja2.spec b/python-jinja2.spec index 5968ece..7f0e836 100644 --- a/python-jinja2.spec +++ b/python-jinja2.spec @@ -1,24 +1,16 @@ %{!?python_sitearch: %define python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")} Name: python-jinja2 -Version: 2.1.1 -Release: 2%{?dist} +Version: 2.2.1 +Release: 1%{?dist} Summary: General purpose template engine - Group: Development/Languages License: BSD URL: http://jinja.pocoo.org/ Source0: http://pypi.python.org/packages/source/J/Jinja2/Jinja2-%{version}.tar.gz -Patch0: %{name}-docs.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: python-devel - -%if 0%{?fedora} >= 8 -BuildRequires: python-setuptools-devel -%else -BuildRequires: python-setuptools -%endif - +BuildRequires: python-setuptools-devel Requires: python-babel >= 0.8 %description @@ -35,22 +27,26 @@ environments. %prep %setup -q -n Jinja2-%{version} -%patch0 -p1 -b .docs %build -CFLAGS="$RPM_OPT_FLAGS" %{__python} setup.py build +CFLAGS="$RPM_OPT_FLAGS" %{__python} setup.py --with-speedups build %install rm -rf %{buildroot} -%{__python} setup.py install -O1 --skip-build --root %{buildroot} +%{__python} setup.py --with-speedups install -O1 --skip-build \ + --root %{buildroot} # fix EOL sed -i 's|\r$||g' LICENSE -# fix wrong permission -%{__chmod} 0755 %{buildroot}%{python_sitearch}/jinja2/_speedups.so +# ensure correct permission +chmod 0755 %{buildroot}%{python_sitearch}/jinja2/_speedups.so + +# remove hidden file +rm -rf docs/_build/html/.buildinfo + %clean rm -rf %{buildroot} @@ -64,6 +60,15 @@ rm -rf %{buildroot} %changelog +* Sat Sep 19 2009 Thomas Moschny - 2.2.1-1 +- Update to 2.2.1, mainly a bugfix release. +- Remove patch no longer needed. +- Remove conditional for FC-8. +- Compilation of speedup module has to be explicitly requested now. + +* Sun Jul 26 2009 Fedora Release Engineering - 2.1.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + * Thu Feb 26 2009 Fedora Release Engineering - 2.1.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild @@ -85,4 +90,3 @@ rm -rf %{buildroot} * Sun Jun 29 2008 Thomas Moschny - 2.0-0.1.rc1 - Modified specfile from the existing python-jinja package. - diff --git a/sources b/sources index b485bf3..b4fdf34 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -b37fc262e4f613eec57c3defe6aea97c Jinja2-2.1.1.tar.gz +fea849d68891218eb0b21c170f1c32d5 Jinja2-2.2.1.tar.gz From 4cc307f058847d4583736518f4a723f6d0d1807a Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 26 Nov 2009 01:52:20 +0000 Subject: [PATCH 3/7] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 2ba35e3..54df830 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: python-jinja2 -# $Id$ +# $Id: Makefile,v 1.1 2008/07/23 03:02:27 kevin Exp $ NAME := python-jinja2 SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 791ea4823dd5b6a3b7d35fcfc8e8dd3c0ada6bcf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 10:25:24 +0000 Subject: [PATCH 4/7] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - import.log | 4 ---- 4 files changed, 26 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch delete mode 100644 import.log diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 54df830..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: python-jinja2 -# $Id: Makefile,v 1.1 2008/07/23 03:02:27 kevin Exp $ -NAME := python-jinja2 -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index 42f697a..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -EL-5 diff --git a/import.log b/import.log deleted file mode 100644 index 2d38857..0000000 --- a/import.log +++ /dev/null @@ -1,4 +0,0 @@ -python-jinja2-2_0-2_fc9:HEAD:python-jinja2-2.0-2.fc9.src.rpm:1216886150 -python-jinja2-2_1-1_fc10:HEAD:python-jinja2-2.1-1.fc10.src.rpm:1229610786 -python-jinja2-2_1_1-1_fc10:HEAD:python-jinja2-2.1.1-1.fc10.src.rpm:1231601194 -python-jinja2-2_2_1-1_fc11:EL-5:python-jinja2-2.2.1-1.fc11.src.rpm:1253470104 From b11c4c490f19ffd75d62294f690126697901ef01 Mon Sep 17 00:00:00 2001 From: Thomas Moschny Date: Sat, 14 Jun 2014 01:36:42 +0200 Subject: [PATCH 5/7] Fix CVE-2014-1402 (using patch from RHSA-2014:0747). --- Jinja2-2.2.1-fix-CVE-2014-1402.patch | 64 ++++++++++++++++++++++++++++ python-jinja2.spec | 11 ++++- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 Jinja2-2.2.1-fix-CVE-2014-1402.patch diff --git a/Jinja2-2.2.1-fix-CVE-2014-1402.patch b/Jinja2-2.2.1-fix-CVE-2014-1402.patch new file mode 100644 index 0000000..90fadbc --- /dev/null +++ b/Jinja2-2.2.1-fix-CVE-2014-1402.patch @@ -0,0 +1,64 @@ +--- jinja2/bccache.py.orig 2014-05-30 11:39:41.313169820 +0200 ++++ jinja2/bccache.py 2014-05-30 11:39:46.512160066 +0200 +@@ -20,6 +20,9 @@ + import cPickle as pickle + import fnmatch + from cStringIO import StringIO ++import os ++import errno ++import stat + try: + from hashlib import sha1 + except ImportError: +@@ -173,7 +176,9 @@ + two arguments: The directory where the cache items are stored and a + pattern string that is used to build the filename. + +- If no directory is specified the system temporary items folder is used. ++ If no directory is specified a default cache directory is selected. On ++ Windows the user's temp directory is used, on UNIX systems a directory ++ is created for the user in the system temp directory. + + The pattern can be used to have multiple separate caches operate on the + same directory. The default pattern is ``'__jinja2_%s.cache'``. ``%s`` +@@ -186,10 +191,39 @@ + + def __init__(self, directory=None, pattern='__jinja2_%s.cache'): + if directory is None: +- directory = tempfile.gettempdir() ++ directory = self._get_default_cache_dir() + self.directory = directory + self.pattern = pattern + ++ def _get_default_cache_dir(self): ++ tmpdir = tempfile.gettempdir() ++ ++ # On windows the temporary directory is used specific unless ++ # explicitly forced otherwise. We can just use that. ++ if os.name == 'nt': ++ return tmpdir ++ if not hasattr(os, 'getuid'): ++ raise RuntimeError('Cannot determine safe temp directory. You ' ++ 'need to explicitly provide one.') ++ ++ dirname = '_jinja2-cache-%d' % os.getuid() ++ actual_dir = os.path.join(tmpdir, dirname) ++ try: ++ os.mkdir(actual_dir, stat.S_IRWXU) # 0o700 ++ except OSError as e: ++ if e.errno != errno.EEXIST: ++ raise ++ ++ actual_dir_stat = os.lstat(actual_dir) ++ if actual_dir_stat.st_uid != os.getuid() \ ++ or not stat.S_ISDIR(actual_dir_stat.st_mode) \ ++ or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU: ++ raise RuntimeError('Temporary directory \'%s\' has an incorrect ' ++ 'owner, permissions, or type.' % actual_dir) ++ ++ ++ return actual_dir ++ + def _get_cache_filename(self, bucket): + return path.join(self.directory, self.pattern % bucket.key) + diff --git a/python-jinja2.spec b/python-jinja2.spec index 7f0e836..1cd0102 100644 --- a/python-jinja2.spec +++ b/python-jinja2.spec @@ -2,12 +2,17 @@ Name: python-jinja2 Version: 2.2.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: General purpose template engine Group: Development/Languages License: BSD URL: http://jinja.pocoo.org/ Source0: http://pypi.python.org/packages/source/J/Jinja2/Jinja2-%{version}.tar.gz +# This patch consists of two upstream patches merged and rebased +# (the first upstream patch introduced CVE-2014-0012 and the second fixed it) +# https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa +# https://github.com/mitsuhiko/jinja2/pull/296/files +Patch0: Jinja2-2.2.1-fix-CVE-2014-1402.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: python-devel BuildRequires: python-setuptools-devel @@ -27,6 +32,7 @@ environments. %prep %setup -q -n Jinja2-%{version} +%patch0 -p0 %build @@ -60,6 +66,9 @@ rm -rf %{buildroot} %changelog +* Fri Jun 13 2014 Thomas Moschny - 2.2.1-2 +- Fix CVE-2014-1402 (using patch from RHSA-2014:0747). + * Sat Sep 19 2009 Thomas Moschny - 2.2.1-1 - Update to 2.2.1, mainly a bugfix release. - Remove patch no longer needed. From 187d1b176d8a4cf10e0e59c4a84b8b92660ce108 Mon Sep 17 00:00:00 2001 From: Thomas Moschny Date: Fri, 18 Jul 2014 18:37:01 +0200 Subject: [PATCH 6/7] Update patch for Python 2.4 (rhbz#1114823). --- Jinja2-2.2.1-fix-CVE-2014-1402.patch | 13 +++++++------ python-jinja2.spec | 7 +++++-- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/Jinja2-2.2.1-fix-CVE-2014-1402.patch b/Jinja2-2.2.1-fix-CVE-2014-1402.patch index 90fadbc..ad41dbc 100644 --- a/Jinja2-2.2.1-fix-CVE-2014-1402.patch +++ b/Jinja2-2.2.1-fix-CVE-2014-1402.patch @@ -1,6 +1,7 @@ ---- jinja2/bccache.py.orig 2014-05-30 11:39:41.313169820 +0200 -+++ jinja2/bccache.py 2014-05-30 11:39:46.512160066 +0200 -@@ -20,6 +20,9 @@ +diff -up Jinja2-2.2.1/jinja2/bccache.py.orig Jinja2-2.2.1/jinja2/bccache.py +--- Jinja2-2.2.1/jinja2/bccache.py.orig 2009-08-05 18:41:50.000000000 +0200 ++++ Jinja2-2.2.1/jinja2/bccache.py 2014-07-18 18:33:08.039204468 +0200 +@@ -20,6 +20,9 @@ import tempfile import cPickle as pickle import fnmatch from cStringIO import StringIO @@ -10,7 +11,7 @@ try: from hashlib import sha1 except ImportError: -@@ -173,7 +176,9 @@ +@@ -173,7 +176,9 @@ class FileSystemBytecodeCache(BytecodeCa two arguments: The directory where the cache items are stored and a pattern string that is used to build the filename. @@ -21,7 +22,7 @@ The pattern can be used to have multiple separate caches operate on the same directory. The default pattern is ``'__jinja2_%s.cache'``. ``%s`` -@@ -186,10 +191,39 @@ +@@ -186,10 +191,39 @@ class FileSystemBytecodeCache(BytecodeCa def __init__(self, directory=None, pattern='__jinja2_%s.cache'): if directory is None: @@ -45,7 +46,7 @@ + actual_dir = os.path.join(tmpdir, dirname) + try: + os.mkdir(actual_dir, stat.S_IRWXU) # 0o700 -+ except OSError as e: ++ except OSError, e: + if e.errno != errno.EEXIST: + raise + diff --git a/python-jinja2.spec b/python-jinja2.spec index 1cd0102..4786a73 100644 --- a/python-jinja2.spec +++ b/python-jinja2.spec @@ -2,7 +2,7 @@ Name: python-jinja2 Version: 2.2.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: General purpose template engine Group: Development/Languages License: BSD @@ -32,7 +32,7 @@ environments. %prep %setup -q -n Jinja2-%{version} -%patch0 -p0 +%patch0 -p1 %build @@ -66,6 +66,9 @@ rm -rf %{buildroot} %changelog +* Fri Jul 18 2014 Thomas Moschny - 2.2.1-3 +- Update patch for Python 2.4 (rhbz#1114823). + * Fri Jun 13 2014 Thomas Moschny - 2.2.1-2 - Fix CVE-2014-1402 (using patch from RHSA-2014:0747). From 126b994a74b549e64e9bac55c90b08cf062ebb5e Mon Sep 17 00:00:00 2001 From: Thomas Moschny Date: Fri, 1 Aug 2014 21:12:55 +0200 Subject: [PATCH 7/7] Add dependency on python-setuptools (rhbz#1121241). --- python-jinja2.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/python-jinja2.spec b/python-jinja2.spec index 4786a73..e443d08 100644 --- a/python-jinja2.spec +++ b/python-jinja2.spec @@ -2,7 +2,7 @@ Name: python-jinja2 Version: 2.2.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: General purpose template engine Group: Development/Languages License: BSD @@ -17,6 +17,7 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: python-devel BuildRequires: python-setuptools-devel Requires: python-babel >= 0.8 +Requires: python-setuptools %description Jinja2 is a template engine written in pure Python. It provides a @@ -66,6 +67,9 @@ rm -rf %{buildroot} %changelog +* Fri Aug 1 2014 Thomas Moschny - 2.2.1-4 +- Add dependency on python-setuptools (rhbz#1121241). + * Fri Jul 18 2014 Thomas Moschny - 2.2.1-3 - Update patch for Python 2.4 (rhbz#1114823).