Update to v2.22

This fixes CVE-2018-18074.

.gitignore

@@ -39,3 +39,6 @@
 /requests-v2.18.4.tar.gz
 /requests-v2.19.0.tar.gz
 /requests-v2.19.1.tar.gz
+/requests-v2.20.0.tar.gz
+/requests-v2.21.0.tar.gz
+/requests-v2.22.0.tar.gz

dont-import-OrderedDict-from-urllib3.patch

@@ -1,28 +0,0 @@
-From 152550287d6538e5cc7649bcf685a5a0b35058dd Mon Sep 17 00:00:00 2001
-From: Jeremy Cline <jcline@redhat.com>
-Date: Tue, 12 Jun 2018 14:06:00 -0400
-Subject: [PATCH] Don't import OrderedDict from urllib3
-
-We unbundle urllib3, just use collections (py2.7+)
-
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- requests/compat.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/requests/compat.py b/requests/compat.py
-index 6b9c6fac..6ba6e460 100644
---- a/requests/compat.py
-+++ b/requests/compat.py
-@@ -45,7 +45,7 @@ if is_py2:
-     from StringIO import StringIO
-     from collections import Callable, Mapping, MutableMapping
- 
--    from urllib3.packages.ordered_dict import OrderedDict
-+    from collections import OrderedDict  # py2.7+
- 
-     builtin_str = str
-     bytes = str
--- 
-2.17.1
-

patch-requests-certs.py-to-use-the-system-CA-bundle.patch

@@ -1,19 +1,19 @@
-From fd9ab446d8479360d2c1c8252508d97d58ed3e0e Mon Sep 17 00:00:00 2001
-From: Jeremy Cline <jeremy@jcline.org>
-Date: Mon, 19 Jun 2017 16:09:02 -0400
+From d5a4f2908fab5ca16eb59db8b18eda7a94a37b04 Mon Sep 17 00:00:00 2001
+From: Jeremy Cline <jcline@redhat.com>
+Date: Thu, 13 Dec 2018 10:55:29 -0500
 Subject: [PATCH] Patch requests/certs.py to use the system CA bundle
 
-Signed-off-by: Jeremy Cline <jeremy@jcline.org>
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
 ---
- requests/certs.py | 11 ++++++++++-
- setup.py          |  1 -
- 2 files changed, 10 insertions(+), 2 deletions(-)
+ requests/certs.py | 8 +++++++-
+ setup.py          | 1 -
+ 2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/requests/certs.py b/requests/certs.py
-index d1a378d..7b103ba 100644
+index d1a378d7..5eb2f1a9 100644
 --- a/requests/certs.py
 +++ b/requests/certs.py
-@@ -11,8 +11,17 @@ only one — the one from the certifi package.
+@@ -11,8 +11,14 @@ only one — the one from the certifi package.
  If you are packaging Requests, e.g., for a Linux distribution or a managed
  environment, you can change the definition of where() to return a separately
  packaged CA bundle.
@@ -22,28 +22,25 @@ index d1a378d..7b103ba 100644
 +by the ca-certificates RPM package.
  """
 -from certifi import where
-+try:
-+    from certifi import where
-+except ImportError:
-+    def where():
-+        """Return the absolute path to the system CA bundle."""
-+        return '/etc/pki/tls/certs/ca-bundle.crt'
++def where():
++    """Return the absolute path to the system CA bundle."""
++    return '/etc/pki/tls/certs/ca-bundle.crt'
 +
  
  if __name__ == '__main__':
      print(where())
 diff --git a/setup.py b/setup.py
-index 93a8507..2db9569 100755
+index 10ce2c62..1f3b2bde 100755
 --- a/setup.py
 +++ b/setup.py
 @@ -45,7 +45,6 @@ requires = [
      'chardet>=3.0.2,<3.1.0',
-     'idna>=2.5,<2.8',
-     'urllib3>=1.21.1,<1.24',
+     'idna>=2.5,<2.9',
+     'urllib3>=1.21.1,<1.26,!=1.25.0,!=1.25.1',
 -    'certifi>=2017.4.17'
  
  ]
- test_requirements = ['pytest-httpbin==0.0.7', 'pytest-cov', 'pytest-mock', 'pytest-xdist', 'PySocks>=1.5.6, !=1.5.7', 'pytest>=2.8.0']
+ test_requirements = [
 -- 
-2.9.4
+2.19.2
 

python-requests.spec

@@ -9,8 +9,8 @@
 
 
 Name:           python-requests
-Version:        2.19.1
-Release:        3%{?dist}
+Version:        2.22.0
+Release:        1%{?dist}
 Summary:        HTTP library, written in Python, for human beings
 
 License:        ASL 2.0
@@ -20,14 +20,6 @@ Source0:        https://github.com/requests/requests/archive/v%{version}/request
 # https://bugzilla.redhat.com/show_bug.cgi?id=904614
 Patch0:         patch-requests-certs.py-to-use-the-system-CA-bundle.patch
 
-# Remove an unnecessary reference to a bundled compat lib in urllib3
-# Some discussion with upstream:
-# - https://twitter.com/sigmavirus24/status/529816751651819520
-# - https://github.com/kennethreitz/requests/issues/1811
-# - https://github.com/kennethreitz/requests/pull/1812
-Patch1:         dont-import-OrderedDict-from-urllib3.patch
-
-
 # https://bugzilla.redhat.com/show_bug.cgi?id=1450608
 Patch2:         Remove-tests-that-use-the-tarpit.patch
 
@@ -41,6 +33,9 @@ Patch3:         requests-2.12.4-tests_nonet.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1567862
 Patch4:         Don-t-inject-pyopenssl-into-urllib3.patch
 
+# https://github.com/kennethreitz/requests/pull/5049
+Patch5:         support-pytest-4.patch
+
 BuildArch:      noarch
 
 %description
@@ -135,18 +130,25 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v
 
 %files -n python2-requests
 %license LICENSE
-%doc README.rst HISTORY.rst
+%doc README.md HISTORY.md
 %{python2_sitelib}/*.egg-info
 %{python2_sitelib}/requests/
 
 %files -n python%{python3_pkgversion}-requests
 %license LICENSE
-%doc README.rst HISTORY.rst
+%doc README.md HISTORY.md
 %{python3_sitelib}/*.egg-info
 %{python3_sitelib}/requests/
 
 
 %changelog
+* Thu May 23 2019 Jeremy Cline <jcline@redhat.com> - 2.22.0-1
+- Update to v2.22.0
+- Don't rely on certifi being patched properly to use the system CA bundle
+
+* Mon Oct 29 2018 Jeremy Cline <jeremy@jcline.org> - 2.20.0-1
+- Update to v2.20.0
+
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.19.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (requests-v2.19.1.tar.gz) = 00adbbe63c88117fce25e4e2de4ddfb62f87276d627f97aaf8bc4afbf59a921cac57b87f51a0d99167b42d311fe8ca9723b2c5d3a9e04fb0ee318bf90fd9d4ed
+SHA512 (requests-v2.22.0.tar.gz) = 1259c270e343fc860322b105904232226f26b3b363e9d102d599020fcc7b6e1d524dc6c650181ce3152caebe11d2c60045ddd9c9fc04560294caa284e209c386

support-pytest-4.patch

@@ -0,0 +1,26 @@
+From 7a33a8e523be6aa40c7e5435d3c5d92f2cc6e9a0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Mon, 8 Apr 2019 18:04:22 +0200
+Subject: [PATCH] Support pytest 4
+
+Fixes https://github.com/kennethreitz/requests/issues/5048
+
+See https://docs.pytest.org/en/latest/deprecations.html#marks-in-pytest-mark-parametrize
+---
+ tests/test_utils.py |  3 ++-
+ 1 file changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/tests/test_utils.py b/tests/test_utils.py
+index 59b0b0efa..62c51494d 100644
+--- a/tests/test_utils.py
++++ b/tests/test_utils.py
+@@ -33,7 +33,8 @@ class TestSuperLen:
+         'stream, value', (
+             (StringIO.StringIO, 'Test'),
+             (BytesIO, b'Test'),
+-            pytest.mark.skipif('cStringIO is None')((cStringIO, 'Test')),
++            pytest.param(cStringIO, 'Test',
++                         marks=pytest.mark.skipif('cStringIO is None')),
+         ))
+     def test_io_streams(self, stream, value):
+         """Ensures that we properly deal with different kinds of IO streams."""