Compare commits

...
Sign in to create a new pull request.

15 commits

Author SHA1 Message Date
Benjamin A. Beasley
630b49d2af Rebuilt with rust-astral-tokio-tar 0.5.6
- Security update for CVE-2025-62518; fixes RHBZ#2405469
2025-10-22 11:23:10 +01:00
Benjamin A. Beasley
1aa8c07e4a Rebuilt with astral-tokio-tar version 0.5.5
- Security fix for path traversal CVE-2025-59825 / GHSA-3wgq-wrwc-vqmv
2025-09-24 07:44:52 +01:00
Benjamin A. Beasley
26bf181ad1 Update to 0.6.17 2025-05-09 07:43:47 -04:00
Benjamin A. Beasley
3b4bd46fae Update to 0.6.16 (close RHBZ#2361555) 2025-04-25 06:04:49 -04:00
Benjamin A. Beasley
90709a1725 Stop tracking an obsolete patch file
[skip changelog]
2025-04-25 06:04:26 -04:00
Benjamin A. Beasley
da9f9d702c Update to 0.6.14 (close RHBZ#2358763) 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
d6725f15e8 Update to 0.6.13 (close RHBZ#2358064) 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
76fb8fa201 Update to 0.6.12 (close RHBZ#2354987) 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
9ad38437f3 Update to 0.6.11 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
1b5e42f0d4 Update to 0.6.10 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
5671722da2 Update to 0.6.9 (close RHBZ#2353965) 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
9da9716653 Update to 0.6.8 (close RHBZ#2353281) 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
8080763925 Patch for zip 0.6 compatibility 2025-04-12 09:04:53 -04:00
Benjamin A. Beasley
90e3070e1b Update to 0.6.7 (close RHBZ#2353121) 2025-04-12 08:41:01 -04:00
Benjamin A. Beasley
d8be06bba4 Update to 0.6.6 (close RHBZ#2351456) 2025-04-12 08:40:55 -04:00
6 changed files with 155 additions and 124 deletions

12
.gitignore vendored
View file

@ -93,3 +93,15 @@
/uv-0.6.3.tar.gz
/uv-0.6.4.tar.gz
/uv-0.6.5.tar.gz
/uv-0.6.6.tar.gz
/uv-0.6.7.tar.gz
/uv-0.6.8.tar.gz
/uv-0.6.9.tar.gz
/uv-0.6.10.tar.gz
/uv-0.6.11.tar.gz
/uv-0.6.12.tar.gz
/uv-0.6.13.tar.gz
/uv-0.6.14.tar.gz
/uv-0.6.16.tar.gz
/uv-0.6.17.tar.gz
/pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e.tar.gz

View file

@ -1,31 +1,14 @@
From 2dafc904c3578d6f822cf4106b0e09d3086eac27 Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Thu, 23 May 2024 14:45:49 -0400
Subject: [PATCH] Downstream-only: Revert "feat: ensure successful round-trip
of RON (#193)"
This reverts commit 21c6a215432fea9a75b7d15d9a9936af9ccc17cb.
We will not be packaging an alpha version of rust-ron.
---
Cargo.lock | 5 ++---
Cargo.toml | 2 +-
version-ranges/Cargo.toml | 2 +-
version-ranges/src/lib.rs | 10 ----------
4 files changed, 4 insertions(+), 15 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index b3d912a..a6c2eae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -730,15 +730,14 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
diff -Naur pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/Cargo.lock pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/Cargo.lock
--- pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/Cargo.lock 2025-04-23 07:43:48.000000000 -0400
+++ pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/Cargo.lock 2025-05-09 07:39:53.053134339 -0400
@@ -730,15 +730,14 @@
[[package]]
name = "ron"
-version = "0.9.0-alpha.1"
-version = "0.10.1"
+version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7644a2a539ff7fa991c8f4652373cd722d387e39229415103243914249730836"
-checksum = "beceb6f7bf81c73e73aeef6dd1356d9a1b2b4909e1f0fc3e59b034f9572d7b7f"
+checksum = "b91f7eff05f748767f183df4320a63d6936e9c6107d97c9e6bdd9784f4289c94"
dependencies = [
"base64",
@ -36,34 +19,31 @@ index b3d912a..a6c2eae 100644
]
[[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 2424d96..3705919 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ version-ranges = { version = "0.1.0", path = "version-ranges" }
diff -Naur pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/Cargo.toml pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/Cargo.toml
--- pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/Cargo.toml 2025-04-23 07:43:48.000000000 -0400
+++ pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/Cargo.toml 2025-05-09 07:39:01.329212112 -0400
@@ -36,7 +36,7 @@
criterion = { version = "2.7.2", package = "codspeed-criterion-compat" }
env_logger = "0.11.6"
proptest = "1.6.0"
-ron = "=0.9.0-alpha.1"
+ron = "=0.8.1"
-ron = "0.10.1"
+ron = "0.8.1"
varisat = "0.2.2"
version-ranges = { version = "0.1.0", path = "version-ranges", features = ["proptest"] }
diff --git a/version-ranges/Cargo.toml b/version-ranges/Cargo.toml
index ffe68d1..7cf5e26 100644
--- a/version-ranges/Cargo.toml
+++ b/version-ranges/Cargo.toml
@@ -18,4 +18,4 @@ serde = ["dep:serde", "smallvec/serde"]
diff -Naur pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/version-ranges/Cargo.toml pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/version-ranges/Cargo.toml
--- pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/version-ranges/Cargo.toml 2025-04-23 07:43:48.000000000 -0400
+++ pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/version-ranges/Cargo.toml 2025-05-09 07:39:08.042586935 -0400
@@ -18,4 +18,4 @@
[dev-dependencies]
proptest = "1.6.0"
-ron = "=0.9.0-alpha.1"
-ron = "0.10.1"
+ron = "0.8.1"
diff --git a/version-ranges/src/lib.rs b/version-ranges/src/lib.rs
index aac7c94..d28984a 100644
--- a/version-ranges/src/lib.rs
+++ b/version-ranges/src/lib.rs
@@ -1210,16 +1210,6 @@ pub mod tests {
diff -Naur pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/version-ranges/src/lib.rs pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/version-ranges/src/lib.rs
--- pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e-original/version-ranges/src/lib.rs 2025-04-23 07:43:48.000000000 -0400
+++ pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e/version-ranges/src/lib.rs 2025-05-09 07:38:19.087818274 -0400
@@ -1210,16 +1210,6 @@
proptest! {
@ -80,6 +60,3 @@ index aac7c94..d28984a 100644
// Testing negate ----------------------------------
#[test]
--
2.48.1

View file

@ -0,0 +1,84 @@
From 557958723e492064a73abaf373294a5f919702ac Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Sat, 12 Apr 2025 09:02:33 -0400
Subject: [PATCH] Revert "Upgrade zip crate to v2 (#12196)"
This reverts commit 277c15bd66c4cda8ca29140e22fbe3fdb676c289.
(Omits changes to Cargo.lock.)
---
Cargo.toml | 2 +-
crates/uv-build-backend/src/wheel.rs | 6 +++---
crates/uv-trampoline-builder/src/lib.rs | 5 ++---
3 files changed, 6 insertions(+), 7 deletions(-)
diff --git a/Cargo.toml b/Cargo.toml
index cd5cf2044..747dd7eba 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -186,7 +186,7 @@ windows-sys = { version = "0.59.0", features = ["Win32_Foundation", "Win32_Secur
winsafe = { version = "0.0.23", features = ["kernel"] }
wiremock = { version = "0.6.2" }
xz2 = { version = "0.1.7" }
-zip = { version = "2.2.3", default-features = false, features = ["deflate"] }
+zip = { version = "0.6.6", default-features = false, features = ["deflate"] }
[workspace.metadata.cargo-shear]
ignored = ["flate2", "xz2"]
diff --git a/crates/uv-build-backend/src/wheel.rs b/crates/uv-build-backend/src/wheel.rs
index 4c606f2dc..778160032 100644
--- a/crates/uv-build-backend/src/wheel.rs
+++ b/crates/uv-build-backend/src/wheel.rs
@@ -632,7 +632,7 @@ impl ZipDirectoryWriter {
) -> Result<Box<dyn Write + 'slf>, Error> {
// 644 is the default of the zip crate.
let permissions = if executable_bit { 775 } else { 664 };
- let options = zip::write::SimpleFileOptions::default()
+ let options = zip::write::FileOptions::default()
.unix_permissions(permissions)
.compression_method(self.compression);
self.writer.start_file(path, options)?;
@@ -643,7 +643,7 @@ impl ZipDirectoryWriter {
impl DirectoryWriter for ZipDirectoryWriter {
fn write_bytes(&mut self, path: &str, bytes: &[u8]) -> Result<(), Error> {
trace!("Adding {}", path);
- let options = zip::write::SimpleFileOptions::default().compression_method(self.compression);
+ let options = zip::write::FileOptions::default().compression_method(self.compression);
self.writer.start_file(path, options)?;
self.writer.write_all(bytes)?;
@@ -678,7 +678,7 @@ impl DirectoryWriter for ZipDirectoryWriter {
fn write_directory(&mut self, directory: &str) -> Result<(), Error> {
trace!("Adding directory {}", directory);
- let options = zip::write::SimpleFileOptions::default().compression_method(self.compression);
+ let options = zip::write::FileOptions::default().compression_method(self.compression);
Ok(self.writer.add_directory(directory, options)?)
}
diff --git a/crates/uv-trampoline-builder/src/lib.rs b/crates/uv-trampoline-builder/src/lib.rs
index 21fc69050..2fb461fc8 100644
--- a/crates/uv-trampoline-builder/src/lib.rs
+++ b/crates/uv-trampoline-builder/src/lib.rs
@@ -5,7 +5,7 @@ use std::str::Utf8Error;
use fs_err::File;
use thiserror::Error;
use uv_fs::Simplified;
-use zip::write::SimpleFileOptions;
+use zip::write::FileOptions;
use zip::ZipWriter;
#[cfg(all(windows, target_arch = "x86"))]
@@ -250,8 +250,7 @@ pub fn windows_script_launcher(
// We're using the zip writer, but with stored compression
// https://github.com/njsmith/posy/blob/04927e657ca97a5e35bb2252d168125de9a3a025/src/trampolines/mod.rs#L75-L82
// https://github.com/pypa/distlib/blob/8ed03aab48add854f377ce392efffb79bb4d6091/PC/launcher.c#L259-L271
- let stored =
- SimpleFileOptions::default().compression_method(zip::CompressionMethod::Stored);
+ let stored = FileOptions::default().compression_method(zip::CompressionMethod::Stored);
let mut archive = ZipWriter::new(Cursor::new(&mut payload));
let error_msg = "Writing to Vec<u8> should never fail";
archive.start_file("__main__.py", stored).expect(error_msg);
--
2.49.0

View file

@ -1,55 +0,0 @@
From 32769daca67af91c1f8bdb5972e500fa9e66c9ea Mon Sep 17 00:00:00 2001
From: konstin <konstin@mailbox.org>
Date: Tue, 4 Feb 2025 18:45:16 +0100
Subject: [PATCH] Adapt directory permission test
Adapt the directory permissions test to the changes made in https://github.com/astral-sh/tokio-tar/pull/8.
---
tests/entry.rs | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/tests/entry.rs b/tests/entry.rs
index 5b45669..4c31956 100644
--- a/tests/entry.rs
+++ b/tests/entry.rs
@@ -2,7 +2,7 @@ extern crate tokio_tar as async_tar;
extern crate tempfile;
-use tokio::{fs::File, io::AsyncReadExt};
+use tokio::{fs, fs::File, io::AsyncReadExt};
use tokio_stream::*;
use tempfile::Builder;
@@ -157,7 +157,7 @@ async fn relative_link_deref_error() {
#[tokio::test]
#[cfg(unix)]
-async fn directory_maintains_permissions() {
+async fn directory_permissions_are_cleared() {
use ::std::os::unix::fs::PermissionsExt;
let mut ar = async_tar::Builder::new(Vec::new());
@@ -176,9 +176,19 @@ async fn directory_maintains_permissions() {
let td = t!(Builder::new().prefix("tar").tempdir());
t!(ar.unpack(td.path()).await);
let f = t!(File::open(td.path().join("foo")).await);
- let md = t!(f.metadata().await);
- assert!(md.is_dir());
- assert_eq!(md.permissions().mode(), 0o40777);
+ let from_archive_md = t!(f.metadata().await);
+ assert!(from_archive_md.is_dir());
+
+ // To determine the default umask, create a fresh directory that gets it assigned by the OS.
+ let manually_created = td.path().join("bar");
+ t!(fs::create_dir(&manually_created).await);
+ let f = t!(File::open(&manually_created).await);
+ let loca_md = t!(f.metadata().await);
+
+ assert_eq!(
+ from_archive_md.permissions().mode(),
+ loca_md.permissions().mode()
+ );
}
#[tokio::test]

View file

@ -1,4 +1,4 @@
SHA512 (uv-0.6.5.tar.gz) = cb1564905d56ac5873db91476b9a0a09e450c2cfaf386d9d04b1861d1e798ec43d7f28e03099d732e03cc58f79820a7f825d7d8869b40f71fab4308412e401b5
SHA512 (uv-0.6.17.tar.gz) = aae465ef02a29a856f4de69230f77d31149c95ed5a88e489b46c34aa61020f29dcf406168abea77626e7d5297b2e004a89445f343e3ee763c297981b0d50233a
SHA512 (rs-async-zip-c909fda63fcafe4af496a07bfda28a5aae97e58d.tar.gz) = 3a309566f4925b02496fcf19bc2865968edf6fb65082ca4079d2cee79e6b0353a1910c079f2afe656da0d0f6ddde5102052a221ea35a7dabc6d690a11218b20a
SHA512 (pubgrub-b70cf707aa43f21b32f3a61b8a0889b15032d5c4.tar.gz) = 401ea5ca16e978d5407a1400e4e27cec9fcac11332067ee1ed8a3bc511901e08fc421ce875ebbb0990593ed549a4a5f4620914a71ae3490c7b8ae0f7b26b5937
SHA512 (pubgrub-a3b4db3abb1829ce889fb89fa6d157fef529ef7e.tar.gz) = 3e434326040445b836bbbb5e3af186a480198cae3d9b3bc78fa1e8c7f78b558ef15de88c6c941d25ada6be80ca7bb5cf1e1c10647b3e991aeb44cb58acccff35
SHA512 (tl-6e25b2ee2513d75385101a8ff9f591ef51f314ec.tar.gz) = 4abbc4240ed129c92da8d616e27a6df0f24cdc85a0803acfdae588ca91f9e5b8d482e3ac88b2e657ff68917b1b43cef1e7ef3c887f624659b231fa5a13fcae68

59
uv.spec
View file

@ -14,7 +14,7 @@
%bcond it 0
Name: uv
Version: 0.6.5
Version: 0.6.17
Release: %autorelease
Summary: An extremely fast Python package installer and resolver, written in Rust
@ -161,9 +161,9 @@ Source100: %{async_zip_git}/archive/%{async_zip_rev}/rs-async-zip-%{async_z
# We therefore bundle the fork as prescribed in
# https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/#_replacing_git_dependencies
%global pubgrub_git https://github.com/astral-sh/pubgrub
%global pubgrub_rev b70cf707aa43f21b32f3a61b8a0889b15032d5c4
%global pubgrub_baseversion 0.3.0~alpha.1
%global pubgrub_snapdate 20250202
%global pubgrub_rev a3b4db3abb1829ce889fb89fa6d157fef529ef7e
%global pubgrub_baseversion 0.3.0
%global pubgrub_snapdate 20250423
%global version_ranges_baseversion 0.1.1
Source200: %{pubgrub_git}/archive/%{pubgrub_rev}/pubgrub-%{pubgrub_rev}.tar.gz
@ -198,6 +198,14 @@ Patch: 0001-Downstream-only-do-not-override-the-default-allocato.patch
# https://github.com/astral-sh/uv/issues/4451
Patch: 0001-Downstream-patch-always-find-the-system-wide-uv-exec.patch
# Downstream-only: Revert "Upgrade zip crate to v2 (#12196)"
# This reverts commit 277c15bd66c4cda8ca29140e22fbe3fdb676c289.
# (Omits changes to Cargo.lock.)
#
# This is required for EPEL10.0 only, since upgrading rust-zip across a SemVer
# boundary is blocked by policy.
Patch: 0001-Revert-Upgrade-zip-crate-to-v2-12196.patch
# These patches are for the forked, bundled async_zip crate.
#
# Revert "Update zip requirement from 0.6.3 to 2.1.5"
@ -213,8 +221,11 @@ Patch102: https://github.com/Majored/rs-async-zip/pull/153.patch
#
# Downstream-only: Revert "feat: ensure successful round-trip of RON (#193)"
# This reverts commit 21c6a215432fea9a75b7d15d9a9936af9ccc17cb.
# We will not be packaging an alpha version of rust-ron. We can adjust this
# after ron 0.9.x is released.
#
# The pubgrub in current uv releases now requests ron 0.10.0, which we have in
# Fedora and in the EPEL10 leading branch, but which we are prevented from
# updating without a compat package in EPEL10.0. Therefore, we keep patching uv
# to use ron 0.8.1 in order to ship uv 0.6.17, the final 0.6.x release.
Patch200: 0001-Downstream-only-Revert-feat-ensure-successful-round-.patch
# https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval
@ -540,9 +551,12 @@ tomcli set crates/uv/Cargo.toml lists delitem features.default 'crates-io'
# Omit tests requiring wiremock; its dependency tree is too large and complex
# to consider packaging it right now. The conditional #[cfg(any())] is always
# false.
tomcli set crates/uv-auth/Cargo.toml del dev-dependencies.wiremock
sed -r -i 's/^#\[cfg\(test\)\]/#[cfg(any())]\r&/' \
crates/uv-auth/src/middleware.rs
tomcli set crates/uv-auth/Cargo.toml del dev-dependencies.wiremock
tomcli set crates/uv/Cargo.toml del dev-dependencies.wiremock
sed -r -i 's/^mod pip_install;$/#[cfg(any())]\r&/' \
crates/uv/tests/it/main.rs
%if %{without it}
# Integration tests (it crate) nearly all require specific Python interpreter
@ -554,7 +568,7 @@ tomcli set crates/uv-auth/Cargo.toml del dev-dependencies.wiremock
mods="${mods-}${mods+|}branching_urls"
mods="${mods-}${mods+|}build_backend"
mods="${mods-}${mods+|}pip_(check|list|show|tree|uninstall)"
mods="${mods-}${mods+|}python_(dir|find|install|pin)"
mods="${mods-}${mods+|}python_(dir|find|install|list|pin)"
mods="${mods-}${mods+|}venv"
mods="${mods-}${mods+|}workspace"
comment='Downstream-only: skip, needs specific Python interpreter versions'
@ -582,11 +596,11 @@ tomcli set crates/uv/Cargo.toml del dependencies.tracing-durations-export
# tomcli set crates/uv/Cargo.toml str dev-dependencies.foocrate.version 0.1.2
# etcetera
# wanted: 0.9.0
# wanted: 0.10.0
# currently packaged: 0.8.0
# https://bugzilla.redhat.com/show_bug.cgi?id=2348721
tomcli set Cargo.toml str workspace.dependencies.etcetera.version \
'>=0.8.0, <0.10.0'
'>=0.8.0, <0.11.0'
# mailparse
# wanted: 0.16.0
@ -595,19 +609,6 @@ tomcli set Cargo.toml str workspace.dependencies.etcetera.version \
tomcli set Cargo.toml str workspace.dependencies.mailparse.version \
'>=0.15.0, <0.17.0'
# unicode-width
# wanted: 0.1.13
# currently packaged: 0.1.12 (or 0.1.13+really0.1.12)
# This is a whole mess: https://github.com/unicode-rs/unicode-width/issues/55,
# https://github.com/unicode-rs/unicode-width/issues/66
#
# Once upstream switches to 0.2.0, https://github.com/astral-sh/uv/pull/7632,
# we will no longer need to patch this; however, for now the upstream change is
# waiting for textwrap to make a release that includes
# https://github.com/mgeisler/textwrap/commit/ef91a27bcf5f4cf50ee12993032b227982ecf52e.
tomcli set Cargo.toml str \
workspace.dependencies.unicode-width.version '0.1.12'
%cargo_prep
@ -691,6 +692,7 @@ install -t '%{buildroot}%{_sysconfdir}/uv' -p -m 0644 -D '%{SOURCE1}'
#
# cargo test -p uv-auth --lib:
skip="${skip-} --skip keyring::tests::fetch_url_no_host"
skip="${skip-} --skip keyring::tests::fetch_url_with_empty_username"
skip="${skip-} --skip keyring::tests::fetch_url_with_no_username"
skip="${skip-} --skip keyring::tests::fetch_url_with_password"
@ -733,6 +735,17 @@ skip="${skip-} --skip lock::tests::missing_dependency_source_version_unambiguous
skip="${skip-} --skip lock::tests::missing_dependency_version_unambiguous"
%endif
# Trivial differences in --help output formatting (whitespace)
skip="${skip-} --skip help::help"
skip="${skip-} --skip help::help_flag"
skip="${skip-} --skip help::help_flag_subcommand"
skip="${skip-} --skip help::help_flag_subsubcommand"
skip="${skip-} --skip help::help_short_flag"
skip="${skip-} --skip help::help_subcommand"
skip="${skip-} --skip help::help_subsubcommand"
skip="${skip-} --skip help::help_with_global_option"
skip="${skip-} --skip help::help_with_no_pager"
%cargo_test -- -- --exact ${skip-}
%endif