From 9e8fb6e2a2a56ae23472322d34812f65d811e610 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Mon, 17 May 2021 13:38:13 +0200 Subject: [PATCH 1/3] Backport security fix from pip 21.1.1 --- ...git-references-on-unicode-separators.patch | 34 +++++++++++++++++++ python-pip.spec | 12 ++++++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 don-t-split-git-references-on-unicode-separators.patch diff --git a/don-t-split-git-references-on-unicode-separators.patch b/don-t-split-git-references-on-unicode-separators.patch new file mode 100644 index 0000000..707e1e8 --- /dev/null +++ b/don-t-split-git-references-on-unicode-separators.patch @@ -0,0 +1,34 @@ +From 71ded0935e6c87d6e14439f667990de18bf82cb0 Mon Sep 17 00:00:00 2001 +From: Karolina Surma +Date: Mon, 17 May 2021 13:34:47 +0200 +Subject: [PATCH] Don't split git references on unicode separators + +--- + src/pip/_internal/vcs/git.py | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py +index a9c7fb6..b38625e 100644 +--- a/src/pip/_internal/vcs/git.py ++++ b/src/pip/_internal/vcs/git.py +@@ -142,9 +142,15 @@ class Git(VersionControl): + pass + + refs = {} +- for line in output.strip().splitlines(): ++ # NOTE: We do not use splitlines here since that would split on other ++ # unicode separators, which can be maliciously used to install a ++ # different revision. ++ for line in output.strip().split("\n"): ++ line = line.rstrip("\r") ++ if not line: ++ continue + try: +- sha, ref = line.split() ++ sha, ref = line.split(" ", maxsplit=2) + except ValueError: + # Include the offending line to simplify troubleshooting if + # this error ever occurs. +-- +2.31.1 + diff --git a/python-pip.spec b/python-pip.spec index e1a1b86..b1888d3 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -19,7 +19,7 @@ Name: python-%{srcname} # When updating, update the bundled libraries versions bellow! # You can use vendor_meta.sh in the dist git repo Version: %{base_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -92,6 +92,13 @@ Patch4: dummy-certifi.patch # this warning is juts moot. Also, the warning breaks CPython test suite. Patch5: nowarn-pip._internal.main.patch +# Don't split git references on unicode separators, +# which could be maliciously used to install a different revision on the +# repository. +# Security patch backported from pip 21.1.1 +# Upstream PR: https://github.com/pypa/pip/pull/9827 +Patch8: don-t-split-git-references-on-unicode-separators.patch + # Downstream only patch # Users might have local installations of pip from using # `pip install --user --upgrade pip` on older/newer versions. @@ -401,6 +408,9 @@ pytest_k='not completion and %{python_wheeldir}/%{python_wheelname} %changelog +* Mon May 17 2021 Karolina Surma - 20.2.2-2 +- Backport security fix from pip 21.1.1 + * Wed Aug 05 2020 Tomas Orsava - 20.2.2-1 - Update to 20.2.2 (#1838553) From 3fea8c719cb99e529aa72d456e1c37d363b2912d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 30 Aug 2021 12:11:06 +0200 Subject: [PATCH 2/3] Backport: Don't put an underscore in Python 3.10 compatibility tag Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1999035 --- python-pip.spec | 11 ++++++++++- python3.10-abi-tag-fix.patch | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 python3.10-abi-tag-fix.patch diff --git a/python-pip.spec b/python-pip.spec index b1888d3..b364d8b 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -19,7 +19,7 @@ Name: python-%{srcname} # When updating, update the bundled libraries versions bellow! # You can use vendor_meta.sh in the dist git repo Version: %{base_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -99,6 +99,11 @@ Patch5: nowarn-pip._internal.main.patch # Upstream PR: https://github.com/pypa/pip/pull/9827 Patch8: don-t-split-git-references-on-unicode-separators.patch +# Don't put an underscore in the version portion of Python 3.10 compatibility tags +# From https://github.com/pypa/packaging/pull/355 (merged upstream) +# Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1999035 +Patch9: python3.10-abi-tag-fix.patch + # Downstream only patch # Users might have local installations of pip from using # `pip install --user --upgrade pip` on older/newer versions. @@ -408,6 +413,10 @@ pytest_k='not completion and %{python_wheeldir}/%{python_wheelname} %changelog +* Mon Aug 30 2021 Miro Hrončok - 20.2.2-3 +- Properly recognize Python 3.10 wheel tags +- Fixes: rhbz#1999035 + * Mon May 17 2021 Karolina Surma - 20.2.2-2 - Backport security fix from pip 21.1.1 diff --git a/python3.10-abi-tag-fix.patch b/python3.10-abi-tag-fix.patch new file mode 100644 index 0000000..a1399af --- /dev/null +++ b/python3.10-abi-tag-fix.patch @@ -0,0 +1,33 @@ +From a6253448766965e34f1d0dd58cdf317790d25dd7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Tue, 24 Nov 2020 12:06:14 +0100 +Subject: [PATCH] Don't put an underscore in the version portion of Python 3.10 + compatibility tags + +PEP 641 is rejected. + +See https://discuss.python.org/t/5513/42 +See https://www.python.org/dev/peps/pep-0641/ + +Fixes https://github.com/pypa/packaging/issues/372 + +Co-authored-by: Pradyun Gedam +--- + +diff --git a/src/pip/_vendor/packaging/tags.py b/src/pip/_vendor/packaging/tags.py +index 9064910..5d901e9 100644 +--- a/src/pip/_vendor/packaging/tags.py ++++ b/src/pip/_vendor/packaging/tags.py +@@ -722,11 +722,7 @@ def interpreter_version(**kwargs): + + def _version_nodot(version): + # type: (PythonVersion) -> str +- if any(v >= 10 for v in version): +- sep = "_" +- else: +- sep = "" +- return sep.join(map(str, version)) ++ return "".join(map(str, version)) + + + def sys_tags(**kwargs): From 1c6783fac59f395eeee62a448ebc033b68fd0281 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Wed, 6 Oct 2021 16:07:04 +0200 Subject: [PATCH 3/3] Remove bundled windows executables Resolves: rhbz#2005453 --- python-pip.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/python-pip.spec b/python-pip.spec index b364d8b..74093da 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -19,7 +19,7 @@ Name: python-%{srcname} # When updating, update the bundled libraries versions bellow! # You can use vendor_meta.sh in the dist git repo Version: %{base_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -280,6 +280,9 @@ ln -s %{python_wheeldir} tests/data/common_wheels # As of 20.1b1, this workaround was sufficient to get around the missing dependency sed -i -e 's/csv23/csv/g' tests/lib/wheel.py +# Remove windows executable binaries +rm -v src/pip/_vendor/distlib/*.exe +sed -i '/\.exe/d' setup.py %build %py3_build_wheel @@ -413,6 +416,10 @@ pytest_k='not completion and %{python_wheeldir}/%{python_wheelname} %changelog +* Wed Oct 06 2021 Charalampos Stratakis - 20.2.2-4 +- Remove bundled windows executables +- Resolves: rhbz#2005453 + * Mon Aug 30 2021 Miro Hrončok - 20.2.2-3 - Properly recognize Python 3.10 wheel tags - Fixes: rhbz#1999035