From 968486425245e01bac658e8241a65980788b9b15 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 16 Apr 2018 10:40:45 -0400 Subject: [PATCH 1/6] Don't inject pyopenssl into urllib3 (rhbz 1567862) Signed-off-by: Jeremy Cline --- Don-t-inject-pyopenssl-into-urllib3.patch | 34 +++++++++++++++++++++++ python-requests.spec | 8 +++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 Don-t-inject-pyopenssl-into-urllib3.patch diff --git a/Don-t-inject-pyopenssl-into-urllib3.patch b/Don-t-inject-pyopenssl-into-urllib3.patch new file mode 100644 index 0000000..10a9793 --- /dev/null +++ b/Don-t-inject-pyopenssl-into-urllib3.patch @@ -0,0 +1,34 @@ +From 86b1fa39fdebdb7bc57131c1a198d4d18e104f95 Mon Sep 17 00:00:00 2001 +From: Jeremy Cline +Date: Mon, 16 Apr 2018 10:35:35 -0400 +Subject: [PATCH] Don't inject pyopenssl into urllib3 + +Fedora ships sufficiently new versions of Python 2 and 3 to make this +unnecessary (rhbz 1567862) + +Signed-off-by: Jeremy Cline +--- + requests/__init__.py | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/requests/__init__.py b/requests/__init__.py +index 268e7dcc..45b2c679 100644 +--- a/requests/__init__.py ++++ b/requests/__init__.py +@@ -79,13 +79,6 @@ except (AssertionError, ValueError): + "version!".format(urllib3.__version__, chardet.__version__), + RequestsDependencyWarning) + +-# Attempt to enable urllib3's SNI support, if possible +-try: +- from urllib3.contrib import pyopenssl +- pyopenssl.inject_into_urllib3() +-except ImportError: +- pass +- + # urllib3's DependencyWarnings should be silenced. + from urllib3.exceptions import DependencyWarning + warnings.simplefilter('ignore', DependencyWarning) +-- +2.17.0 + diff --git a/python-requests.spec b/python-requests.spec index 4005e1d..db8de54 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -9,7 +9,7 @@ Name: python-requests Version: 2.18.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -37,6 +37,9 @@ Patch2: Remove-tests-that-use-the-tarpit.patch # a pretty odd one so this is a niche requirement. Patch3: requests-2.12.4-tests_nonet.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1567862 +Patch4: Don-t-inject-pyopenssl-into-urllib3.patch + BuildArch: noarch %description @@ -166,6 +169,9 @@ popd %endif %changelog +* Mon Apr 16 2018 Jeremy Cline - 2.18.4-4 +- Stop injecting PyOpenSSL (rhbz 1567862) + * Fri Feb 09 2018 Fedora Release Engineering - 2.18.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From beb63d278c12868c82d47576ef41ff40bafe5d3a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 14 May 2018 14:25:33 +0200 Subject: [PATCH 2/6] Conditionalize the tests, useful when bootstrapping Python --- python-requests.spec | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index db8de54..f57b939 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -7,6 +7,16 @@ %{!?python3_pkgversion: %global python3_pkgversion 34} %endif +%if 0%{?_module_build} +# Don't run tests on module-build for now +# See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 +%bcond_with tests +%else +# When bootstrapping Python, we cannot test this yet +%bcond_without tests +%endif + + Name: python-requests Version: 2.18.4 Release: 4%{?dist} @@ -55,11 +65,12 @@ Summary: HTTP library, written in Python, for human beings BuildRequires: python2-devel BuildRequires: python2-chardet BuildRequires: python2-urllib3 -# For tests +%if %{with tests} BuildRequires: python2-pytest BuildRequires: python2-pytest-cov BuildRequires: python2-pytest-httpbin BuildRequires: python2-pytest-mock +%endif Requires: ca-certificates @@ -87,11 +98,12 @@ Summary: HTTP library, written in Python, for human beings BuildRequires: python%{python3_pkgversion}-devel BuildRequires: python%{python3_pkgversion}-chardet BuildRequires: python%{python3_pkgversion}-urllib3 -# For tests +%if %{with tests} BuildRequires: python%{python3_pkgversion}-pytest BuildRequires: python%{python3_pkgversion}-pytest-cov BuildRequires: python%{python3_pkgversion}-pytest-httpbin BuildRequires: python%{python3_pkgversion}-pytest-mock +%endif Requires: python%{python3_pkgversion}-chardet Requires: python%{python3_pkgversion}-urllib3 @@ -136,18 +148,16 @@ popd %{__python} setup.py install --skip-build --root $RPM_BUILD_ROOT -%check -%if ! 0%{?_module_build} -# Don't run tests on module-build for now -# See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 +%if %{with tests} +%check PYTHONPATH=./ py.test %if 0%{?_with_python3} pushd %{py3dir} PYTHONPATH=./ py.test-%{python3_pkgversion} popd %endif -%endif #_module_build +%endif # tests %files -n python2-requests From 60af20a33c2edbc1d44efced10261ff27675a824 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 5 Jun 2018 16:45:30 +0200 Subject: [PATCH 3/6] BR idna, or the tests fail --- python-requests.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/python-requests.spec b/python-requests.spec index f57b939..f0a2b4d 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -65,6 +65,7 @@ Summary: HTTP library, written in Python, for human beings BuildRequires: python2-devel BuildRequires: python2-chardet BuildRequires: python2-urllib3 +BuildRequires: python2-idna %if %{with tests} BuildRequires: python2-pytest BuildRequires: python2-pytest-cov @@ -98,6 +99,7 @@ Summary: HTTP library, written in Python, for human beings BuildRequires: python%{python3_pkgversion}-devel BuildRequires: python%{python3_pkgversion}-chardet BuildRequires: python%{python3_pkgversion}-urllib3 +BuildRequires: python%{python3_pkgversion}-idna %if %{with tests} BuildRequires: python%{python3_pkgversion}-pytest BuildRequires: python%{python3_pkgversion}-pytest-cov From 1d3c2ae27ba515ad115c37cac563df749770a318 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 5 Jun 2018 16:46:46 +0200 Subject: [PATCH 4/6] General cleanup of the specfile - python_sitelib was defined but never used - _with_python3 was True, so I removed the ifs - python3_pkgversion is defined on both Fedora and EPEL - %{py3dir} is deprecated and not needed here - use %pyX_build and %pyX_install macros, stop using %{__python} - run tests against the installed version - some cruft removal --- python-requests.spec | 53 +++++++------------------------------------- 1 file changed, 8 insertions(+), 45 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index f0a2b4d..2ad3ffa 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,12 +1,3 @@ -%global _with_python3 1 -%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print (get_python_lib())")} - -%if 0%{?fedora} -%{!?python3_pkgversion: %global python3_pkgversion 3} -%else -%{!?python3_pkgversion: %global python3_pkgversion 34} -%endif - %if 0%{?_module_build} # Don't run tests on module-build for now # See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 @@ -90,7 +81,6 @@ cumbersome. Python’s built-in urllib2 module provides most of the HTTP capabilities you should need, but the API is thoroughly broken. This library is designed to make HTTP requests easy for developers. -%if 0%{?_with_python3} %package -n python%{python3_pkgversion}-requests Summary: HTTP library, written in Python, for human beings @@ -116,7 +106,6 @@ Most existing Python modules for sending HTTP requests are extremely verbose and cumbersome. Python’s built-in urllib2 module provides most of the HTTP capabilities you should need, but the API is thoroughly broken. This library is designed to make HTTP requests easy for developers. -%endif %prep %autosetup -p1 -n requests-%{version} @@ -124,61 +113,35 @@ designed to make HTTP requests easy for developers. # Unbundle the certificate bundle from mozilla. rm -rf requests/cacert.pem -%if 0%{?_with_python3} -rm -rf %{py3dir} -cp -a . %{py3dir} -%endif # with_python3 - %build -%if 0%{?_with_python3} -pushd %{py3dir} -%{__python3} setup.py build - -popd -%endif - -%{__python} setup.py build +%py2_build +%py3_build %install -rm -rf $RPM_BUILD_ROOT -%if 0%{?_with_python3} -pushd %{py3dir} -%{__python3} setup.py install --skip-build --root $RPM_BUILD_ROOT -popd -%endif - -%{__python} setup.py install --skip-build --root $RPM_BUILD_ROOT +%py2_install +%py3_install %if %{with tests} %check -PYTHONPATH=./ py.test -%if 0%{?_with_python3} -pushd %{py3dir} -PYTHONPATH=./ py.test-%{python3_pkgversion} -popd -%endif +PYTHONPATH=%{buildroot}%{python2_sitelib} %{__python2} -m pytest -v +PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %endif # tests %files -n python2-requests -%defattr(-,root,root,-) -%{!?_licensedir:%global license %%doc} %license LICENSE %doc README.rst HISTORY.rst %{python2_sitelib}/*.egg-info -%dir %{python2_sitelib}/requests -%{python2_sitelib}/requests/* +%{python2_sitelib}/requests/ -%if 0%{?_with_python3} %files -n python%{python3_pkgversion}-requests -%{!?_licensedir:%global license %%doc} %license LICENSE %doc README.rst HISTORY.rst %{python3_sitelib}/*.egg-info %{python3_sitelib}/requests/ -%endif + %changelog * Mon Apr 16 2018 Jeremy Cline - 2.18.4-4 From f9bcf85a1e26c1613a89debc9cd86226f408b513 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 5 Jun 2018 16:55:51 +0200 Subject: [PATCH 5/6] Remove useless shebang --- python-requests.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/python-requests.spec b/python-requests.spec index 2ad3ffa..ae931c0 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -113,6 +113,9 @@ designed to make HTTP requests easy for developers. # Unbundle the certificate bundle from mozilla. rm -rf requests/cacert.pem +# env shebang in nonexecutable file +sed -i '/#!\/usr\/.*python/d' requests/certs.py + %build %py2_build %py3_build From 81e207395f5c25fc6032e06b2a8664301added10 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Tue, 5 Jun 2018 23:07:31 -0400 Subject: [PATCH 6/6] Update to v2.20.0 This fixes CVE-2018-18074. --- .gitignore | 3 ++ Don-t-inject-pyopenssl-into-urllib3.patch | 8 +++-- dont-import-OrderedDict-from-urllib3.patch | 29 ------------------- ...certs.py-to-use-the-system-CA-bundle.patch | 14 ++++----- python-requests.spec | 19 +++++------- sources | 2 +- 6 files changed, 24 insertions(+), 51 deletions(-) delete mode 100644 dont-import-OrderedDict-from-urllib3.patch diff --git a/.gitignore b/.gitignore index 0089e02..ed2dec9 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,6 @@ /requests-v2.18.1.tar.gz /requests-v2.18.2.tar.gz /requests-v2.18.4.tar.gz +/requests-v2.19.0.tar.gz +/requests-v2.19.1.tar.gz +/requests-v2.20.0.tar.gz diff --git a/Don-t-inject-pyopenssl-into-urllib3.patch b/Don-t-inject-pyopenssl-into-urllib3.patch index 10a9793..df24810 100644 --- a/Don-t-inject-pyopenssl-into-urllib3.patch +++ b/Don-t-inject-pyopenssl-into-urllib3.patch @@ -12,10 +12,10 @@ Signed-off-by: Jeremy Cline 1 file changed, 7 deletions(-) diff --git a/requests/__init__.py b/requests/__init__.py -index 268e7dcc..45b2c679 100644 +index a5b3c9c3..e312d314 100644 --- a/requests/__init__.py +++ b/requests/__init__.py -@@ -79,13 +79,6 @@ except (AssertionError, ValueError): +@@ -90,17 +90,6 @@ except (AssertionError, ValueError): "version!".format(urllib3.__version__, chardet.__version__), RequestsDependencyWarning) @@ -23,6 +23,10 @@ index 268e7dcc..45b2c679 100644 -try: - from urllib3.contrib import pyopenssl - pyopenssl.inject_into_urllib3() +- +- # Check cryptography version +- from cryptography import __version__ as cryptography_version +- _check_cryptography(cryptography_version) -except ImportError: - pass - diff --git a/dont-import-OrderedDict-from-urllib3.patch b/dont-import-OrderedDict-from-urllib3.patch deleted file mode 100644 index 0b0279c..0000000 --- a/dont-import-OrderedDict-from-urllib3.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 75f027ac8bc55ad280f7bf72a25db1ce8c1fc76d Mon Sep 17 00:00:00 2001 -From: Jeremy Cline -Date: Mon, 19 Jun 2017 16:19:53 -0400 -Subject: [PATCH] Don't import OrderedDict from urllib3 - -Signed-off-by: Jeremy Cline ---- - requests/compat.py | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/requests/compat.py b/requests/compat.py -index 5c09ea8..61fa0c8 100644 ---- a/requests/compat.py -+++ b/requests/compat.py -@@ -46,7 +46,10 @@ if is_py2: - from Cookie import Morsel - from StringIO import StringIO - -- from urllib3.packages.ordered_dict import OrderedDict -+ try: -+ from collections import OrderedDict # py2.7+ -+ except: -+ from ordereddict import OrderedDict # py2.6 and lower (el6, etc. - - builtin_str = str - bytes = str --- -2.9.4 - diff --git a/patch-requests-certs.py-to-use-the-system-CA-bundle.patch b/patch-requests-certs.py-to-use-the-system-CA-bundle.patch index 06a1e99..a3db03e 100644 --- a/patch-requests-certs.py-to-use-the-system-CA-bundle.patch +++ b/patch-requests-certs.py-to-use-the-system-CA-bundle.patch @@ -1,4 +1,4 @@ -From fd9ab446d8479360d2c1c8252508d97d58ed3e0e Mon Sep 17 00:00:00 2001 +From a8ef690988f92a56226f8b688f1a3638346bca8e Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 19 Jun 2017 16:09:02 -0400 Subject: [PATCH] Patch requests/certs.py to use the system CA bundle @@ -10,7 +10,7 @@ Signed-off-by: Jeremy Cline 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/requests/certs.py b/requests/certs.py -index d1a378d..7b103ba 100644 +index d1a378d7..7b103baf 100644 --- a/requests/certs.py +++ b/requests/certs.py @@ -11,8 +11,17 @@ only one — the one from the certifi package. @@ -33,17 +33,17 @@ index d1a378d..7b103ba 100644 if __name__ == '__main__': print(where()) diff --git a/setup.py b/setup.py -index 93a8507..2db9569 100755 +index 4e2ad936..60de5861 100755 --- a/setup.py +++ b/setup.py @@ -45,7 +45,6 @@ requires = [ 'chardet>=3.0.2,<3.1.0', - 'idna>=2.5,<2.7', - 'urllib3>=1.21.1,<1.23', + 'idna>=2.5,<2.8', + 'urllib3>=1.21.1,<1.25', - 'certifi>=2017.4.17' ] - test_requirements = ['pytest-httpbin==0.0.7', 'pytest-cov', 'pytest-mock', 'pytest-xdist', 'PySocks>=1.5.6, !=1.5.7', 'pytest>=2.8.0'] + test_requirements = [ -- -2.9.4 +2.19.1 diff --git a/python-requests.spec b/python-requests.spec index ae931c0..1a93c48 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -9,8 +9,8 @@ Name: python-requests -Version: 2.18.4 -Release: 4%{?dist} +Version: 2.20.0 +Release: 1%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -20,14 +20,6 @@ Source0: https://github.com/requests/requests/archive/v%{version}/request # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch0: patch-requests-certs.py-to-use-the-system-CA-bundle.patch -# Remove an unnecessary reference to a bundled compat lib in urllib3 -# Some discussion with upstream: -# - https://twitter.com/sigmavirus24/status/529816751651819520 -# - https://github.com/kennethreitz/requests/issues/1811 -# - https://github.com/kennethreitz/requests/pull/1812 -Patch1: dont-import-OrderedDict-from-urllib3.patch - - # https://bugzilla.redhat.com/show_bug.cgi?id=1450608 Patch2: Remove-tests-that-use-the-tarpit.patch @@ -135,18 +127,21 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %files -n python2-requests %license LICENSE -%doc README.rst HISTORY.rst +%doc README.md HISTORY.md %{python2_sitelib}/*.egg-info %{python2_sitelib}/requests/ %files -n python%{python3_pkgversion}-requests %license LICENSE -%doc README.rst HISTORY.rst +%doc README.md HISTORY.md %{python3_sitelib}/*.egg-info %{python3_sitelib}/requests/ %changelog +* Mon Oct 29 2018 Jeremy Cline - 2.20.0-1 +- Update to v2.20.0 + * Mon Apr 16 2018 Jeremy Cline - 2.18.4-4 - Stop injecting PyOpenSSL (rhbz 1567862) diff --git a/sources b/sources index 0e06b51..f80c529 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.18.4.tar.gz) = 8ca20fe18d13b8c62977be0c51617f2ae8618d3d002ad4dc554362828855db7359274efbff0cd13e8c5699508913e91205cffcf306221a70321e74ac10b2d4d7 +SHA512 (requests-v2.20.0.tar.gz) = 766c69d1778e7286232fcd750842e89cd9bb6637076e80fe95fb67f3ccb14049bf74a533de91ef9451ac6f397ad0a6d148eb444009f501178138cdeffc5ee7c4