From 5a18b5a1e8a24cc32cd4d8bc3322ee274389e9f6 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 29 Oct 2018 13:49:15 -0400 Subject: [PATCH 1/2] Update to v2.20.0 This fixes CVE-2018-18074. --- .gitignore | 1 + dont-import-OrderedDict-from-urllib3.patch | 28 ------------------- ...certs.py-to-use-the-system-CA-bundle.patch | 12 ++++---- python-requests.spec | 19 +++++-------- sources | 2 +- 5 files changed, 15 insertions(+), 47 deletions(-) delete mode 100644 dont-import-OrderedDict-from-urllib3.patch diff --git a/.gitignore b/.gitignore index 7f9eb10..ed2dec9 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ /requests-v2.18.4.tar.gz /requests-v2.19.0.tar.gz /requests-v2.19.1.tar.gz +/requests-v2.20.0.tar.gz diff --git a/dont-import-OrderedDict-from-urllib3.patch b/dont-import-OrderedDict-from-urllib3.patch deleted file mode 100644 index d42d2e3..0000000 --- a/dont-import-OrderedDict-from-urllib3.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 152550287d6538e5cc7649bcf685a5a0b35058dd Mon Sep 17 00:00:00 2001 -From: Jeremy Cline -Date: Tue, 12 Jun 2018 14:06:00 -0400 -Subject: [PATCH] Don't import OrderedDict from urllib3 - -We unbundle urllib3, just use collections (py2.7+) - -Signed-off-by: Jeremy Cline ---- - requests/compat.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/requests/compat.py b/requests/compat.py -index 6b9c6fac..6ba6e460 100644 ---- a/requests/compat.py -+++ b/requests/compat.py -@@ -45,7 +45,7 @@ if is_py2: - from StringIO import StringIO - from collections import Callable, Mapping, MutableMapping - -- from urllib3.packages.ordered_dict import OrderedDict -+ from collections import OrderedDict # py2.7+ - - builtin_str = str - bytes = str --- -2.17.1 - diff --git a/patch-requests-certs.py-to-use-the-system-CA-bundle.patch b/patch-requests-certs.py-to-use-the-system-CA-bundle.patch index d958903..a3db03e 100644 --- a/patch-requests-certs.py-to-use-the-system-CA-bundle.patch +++ b/patch-requests-certs.py-to-use-the-system-CA-bundle.patch @@ -1,4 +1,4 @@ -From fd9ab446d8479360d2c1c8252508d97d58ed3e0e Mon Sep 17 00:00:00 2001 +From a8ef690988f92a56226f8b688f1a3638346bca8e Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 19 Jun 2017 16:09:02 -0400 Subject: [PATCH] Patch requests/certs.py to use the system CA bundle @@ -10,7 +10,7 @@ Signed-off-by: Jeremy Cline 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/requests/certs.py b/requests/certs.py -index d1a378d..7b103ba 100644 +index d1a378d7..7b103baf 100644 --- a/requests/certs.py +++ b/requests/certs.py @@ -11,8 +11,17 @@ only one — the one from the certifi package. @@ -33,17 +33,17 @@ index d1a378d..7b103ba 100644 if __name__ == '__main__': print(where()) diff --git a/setup.py b/setup.py -index 93a8507..2db9569 100755 +index 4e2ad936..60de5861 100755 --- a/setup.py +++ b/setup.py @@ -45,7 +45,6 @@ requires = [ 'chardet>=3.0.2,<3.1.0', 'idna>=2.5,<2.8', - 'urllib3>=1.21.1,<1.24', + 'urllib3>=1.21.1,<1.25', - 'certifi>=2017.4.17' ] - test_requirements = ['pytest-httpbin==0.0.7', 'pytest-cov', 'pytest-mock', 'pytest-xdist', 'PySocks>=1.5.6, !=1.5.7', 'pytest>=2.8.0'] + test_requirements = [ -- -2.9.4 +2.19.1 diff --git a/python-requests.spec b/python-requests.spec index 771905e..769da5d 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -9,8 +9,8 @@ Name: python-requests -Version: 2.19.1 -Release: 3%{?dist} +Version: 2.20.0 +Release: 1%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -20,14 +20,6 @@ Source0: https://github.com/requests/requests/archive/v%{version}/request # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch0: patch-requests-certs.py-to-use-the-system-CA-bundle.patch -# Remove an unnecessary reference to a bundled compat lib in urllib3 -# Some discussion with upstream: -# - https://twitter.com/sigmavirus24/status/529816751651819520 -# - https://github.com/kennethreitz/requests/issues/1811 -# - https://github.com/kennethreitz/requests/pull/1812 -Patch1: dont-import-OrderedDict-from-urllib3.patch - - # https://bugzilla.redhat.com/show_bug.cgi?id=1450608 Patch2: Remove-tests-that-use-the-tarpit.patch @@ -135,18 +127,21 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %files -n python2-requests %license LICENSE -%doc README.rst HISTORY.rst +%doc README.md HISTORY.md %{python2_sitelib}/*.egg-info %{python2_sitelib}/requests/ %files -n python%{python3_pkgversion}-requests %license LICENSE -%doc README.rst HISTORY.rst +%doc README.md HISTORY.md %{python3_sitelib}/*.egg-info %{python3_sitelib}/requests/ %changelog +* Mon Oct 29 2018 Jeremy Cline - 2.20.0-1 +- Update to v2.20.0 + * Sat Jul 14 2018 Fedora Release Engineering - 2.19.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild diff --git a/sources b/sources index d55d5ce..f80c529 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.19.1.tar.gz) = 00adbbe63c88117fce25e4e2de4ddfb62f87276d627f97aaf8bc4afbf59a921cac57b87f51a0d99167b42d311fe8ca9723b2c5d3a9e04fb0ee318bf90fd9d4ed +SHA512 (requests-v2.20.0.tar.gz) = 766c69d1778e7286232fcd750842e89cd9bb6637076e80fe95fb67f3ccb14049bf74a533de91ef9451ac6f397ad0a6d148eb444009f501178138cdeffc5ee7c4 From f4fd5a97b9cb4c92b986529f13bf40ea7ed38f7f Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Thu, 13 Dec 2018 10:59:21 -0500 Subject: [PATCH 2/2] Update to v2.22 --- .gitignore | 2 ++ ...certs.py-to-use-the-system-CA-bundle.patch | 35 +++++++++---------- python-requests.spec | 9 ++++- sources | 2 +- support-pytest-4.patch | 26 ++++++++++++++ 5 files changed, 53 insertions(+), 21 deletions(-) create mode 100644 support-pytest-4.patch diff --git a/.gitignore b/.gitignore index ed2dec9..ac8eed4 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,5 @@ /requests-v2.19.0.tar.gz /requests-v2.19.1.tar.gz /requests-v2.20.0.tar.gz +/requests-v2.21.0.tar.gz +/requests-v2.22.0.tar.gz diff --git a/patch-requests-certs.py-to-use-the-system-CA-bundle.patch b/patch-requests-certs.py-to-use-the-system-CA-bundle.patch index a3db03e..a36a7bf 100644 --- a/patch-requests-certs.py-to-use-the-system-CA-bundle.patch +++ b/patch-requests-certs.py-to-use-the-system-CA-bundle.patch @@ -1,19 +1,19 @@ -From a8ef690988f92a56226f8b688f1a3638346bca8e Mon Sep 17 00:00:00 2001 -From: Jeremy Cline -Date: Mon, 19 Jun 2017 16:09:02 -0400 +From d5a4f2908fab5ca16eb59db8b18eda7a94a37b04 Mon Sep 17 00:00:00 2001 +From: Jeremy Cline +Date: Thu, 13 Dec 2018 10:55:29 -0500 Subject: [PATCH] Patch requests/certs.py to use the system CA bundle -Signed-off-by: Jeremy Cline +Signed-off-by: Jeremy Cline --- - requests/certs.py | 11 ++++++++++- - setup.py | 1 - - 2 files changed, 10 insertions(+), 2 deletions(-) + requests/certs.py | 8 +++++++- + setup.py | 1 - + 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/requests/certs.py b/requests/certs.py -index d1a378d7..7b103baf 100644 +index d1a378d7..5eb2f1a9 100644 --- a/requests/certs.py +++ b/requests/certs.py -@@ -11,8 +11,17 @@ only one — the one from the certifi package. +@@ -11,8 +11,14 @@ only one — the one from the certifi package. If you are packaging Requests, e.g., for a Linux distribution or a managed environment, you can change the definition of where() to return a separately packaged CA bundle. @@ -22,28 +22,25 @@ index d1a378d7..7b103baf 100644 +by the ca-certificates RPM package. """ -from certifi import where -+try: -+ from certifi import where -+except ImportError: -+ def where(): -+ """Return the absolute path to the system CA bundle.""" -+ return '/etc/pki/tls/certs/ca-bundle.crt' ++def where(): ++ """Return the absolute path to the system CA bundle.""" ++ return '/etc/pki/tls/certs/ca-bundle.crt' + if __name__ == '__main__': print(where()) diff --git a/setup.py b/setup.py -index 4e2ad936..60de5861 100755 +index 10ce2c62..1f3b2bde 100755 --- a/setup.py +++ b/setup.py @@ -45,7 +45,6 @@ requires = [ 'chardet>=3.0.2,<3.1.0', - 'idna>=2.5,<2.8', - 'urllib3>=1.21.1,<1.25', + 'idna>=2.5,<2.9', + 'urllib3>=1.21.1,<1.26,!=1.25.0,!=1.25.1', - 'certifi>=2017.4.17' ] test_requirements = [ -- -2.19.1 +2.19.2 diff --git a/python-requests.spec b/python-requests.spec index 769da5d..67125bd 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -9,7 +9,7 @@ Name: python-requests -Version: 2.20.0 +Version: 2.22.0 Release: 1%{?dist} Summary: HTTP library, written in Python, for human beings @@ -33,6 +33,9 @@ Patch3: requests-2.12.4-tests_nonet.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1567862 Patch4: Don-t-inject-pyopenssl-into-urllib3.patch +# https://github.com/kennethreitz/requests/pull/5049 +Patch5: support-pytest-4.patch + BuildArch: noarch %description @@ -139,6 +142,10 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %changelog +* Thu May 23 2019 Jeremy Cline - 2.22.0-1 +- Update to v2.22.0 +- Don't rely on certifi being patched properly to use the system CA bundle + * Mon Oct 29 2018 Jeremy Cline - 2.20.0-1 - Update to v2.20.0 diff --git a/sources b/sources index f80c529..3b9c66a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.20.0.tar.gz) = 766c69d1778e7286232fcd750842e89cd9bb6637076e80fe95fb67f3ccb14049bf74a533de91ef9451ac6f397ad0a6d148eb444009f501178138cdeffc5ee7c4 +SHA512 (requests-v2.22.0.tar.gz) = 1259c270e343fc860322b105904232226f26b3b363e9d102d599020fcc7b6e1d524dc6c650181ce3152caebe11d2c60045ddd9c9fc04560294caa284e209c386 diff --git a/support-pytest-4.patch b/support-pytest-4.patch new file mode 100644 index 0000000..dd00e4a --- /dev/null +++ b/support-pytest-4.patch @@ -0,0 +1,26 @@ +From 7a33a8e523be6aa40c7e5435d3c5d92f2cc6e9a0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Mon, 8 Apr 2019 18:04:22 +0200 +Subject: [PATCH] Support pytest 4 + +Fixes https://github.com/kennethreitz/requests/issues/5048 + +See https://docs.pytest.org/en/latest/deprecations.html#marks-in-pytest-mark-parametrize +--- + tests/test_utils.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletions(-) + +diff --git a/tests/test_utils.py b/tests/test_utils.py +index 59b0b0efa..62c51494d 100644 +--- a/tests/test_utils.py ++++ b/tests/test_utils.py +@@ -33,7 +33,8 @@ class TestSuperLen: + 'stream, value', ( + (StringIO.StringIO, 'Test'), + (BytesIO, b'Test'), +- pytest.mark.skipif('cStringIO is None')((cStringIO, 'Test')), ++ pytest.param(cStringIO, 'Test', ++ marks=pytest.mark.skipif('cStringIO is None')), + )) + def test_io_streams(self, stream, value): + """Ensures that we properly deal with different kinds of IO streams."""