November 2021 - openSUSE Commits - openSUSE Mailing Lists

commit python-jedi for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-jedi for openSUSE:Factory checked in at 2021-11-03 17:25:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-jedi (Old) and /work/SRC/openSUSE:Factory/.python-jedi.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-jedi" Wed Nov 3 17:25:16 2021 rev:29 rq:928392 version:0.18.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-jedi/python-jedi.changes 2021-04-15 16:56:43.326608297 +0200 +++ /work/SRC/openSUSE:Factory/.python-jedi.new.1890/python-jedi.changes 2021-11-03 17:25:50.633323374 +0100 @@ -1,0 +2,5 @@ +Sun Oct 31 15:56:52 UTC 2021 - Benjamin Greiner <code(a)bnavigator.de> + +- Force pytest5 because it has the pluggy<1 pin patched out + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-jedi.spec ++++++ --- /var/tmp/diff_new_pack.TE2VGM/_old 2021-11-03 17:25:51.081323619 +0100 +++ /var/tmp/diff_new_pack.TE2VGM/_new 2021-11-03 17:25:51.081323619 +0100 @@ -30,8 +30,8 @@ # PATCH-FIX-UPSTREAM Support pytest completion for Python 3.9 -- gh#davidhalter/jedi#1699 Patch0: https://github.com/davidhalter/jedi/commit/85ec94cf.patch#/jedi-py39-pytest… BuildRequires: %{python_module parso >= 0.8.0} -# need pytest 5 https://github.com/davidhalter/jedi/issues/1660 -BuildRequires: %{python_module pytest < 6.0.0} +# need pytest <6 https://github.com/davidhalter/jedi/issues/1660; pytest4 in Leap cannot work with pluggy 1.0 in :backports +BuildRequires: %{python_module pytest5} BuildRequires: %{python_module setuptools} BuildRequires: %{python_module typing} BuildRequires: fdupes

1 0

commit python-isort for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-isort for openSUSE:Factory checked in at 2021-11-03 17:25:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-isort (Old) and /work/SRC/openSUSE:Factory/.python-isort.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-isort" Wed Nov 3 17:25:17 2021 rev:28 rq:928403 version:5.9.3 Changes: -------- --- /work/SRC/openSUSE:Factory/python-isort/python-isort.changes 2021-08-11 11:47:25.145731927 +0200 +++ /work/SRC/openSUSE:Factory/.python-isort.new.1890/python-isort.changes 2021-11-03 17:25:51.333323757 +0100 @@ -1,0 +2,6 @@ +Sun Oct 31 16:49:09 UTC 2021 - Ben Greiner <code(a)bnavigator.de> + +- Use custom hypothesis profile obs in order to suppress failing + health checks + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-isort.spec ++++++ --- /var/tmp/diff_new_pack.5MCt47/_old 2021-11-03 17:25:51.769323995 +0100 +++ /var/tmp/diff_new_pack.5MCt47/_new 2021-11-03 17:25:51.773323998 +0100 @@ -80,6 +80,16 @@ %setup -q -n isort-%{version} chmod -x LICENSE +echo " +# increase test deadline for slow obs executions +import hypothesis +hypothesis.settings.register_profile( + 'obs', + deadline=5000, + suppress_health_check=[hypothesis.HealthCheck.too_slow] +) +" >> tests/conftest.py + %build %pyproject_wheel @@ -131,6 +141,7 @@ pytest-%{$python_bin_suffix} -v \ -W "ignore::UserWarning" \ -W "ignore::DeprecationWarning" \ + --hypothesis-profile="obs" \ ${ignoretests} \ -k "not (${donttest} ${$python_donttest})" }

1 0

commit chromium for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package chromium for openSUSE:Factory checked in at 2021-11-03 17:25:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/chromium (Old) and /work/SRC/openSUSE:Factory/.chromium.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "chromium" Wed Nov 3 17:25:15 2021 rev:308 rq:928391 version:95.0.4638.69 Changes: -------- --- /work/SRC/openSUSE:Factory/chromium/chromium.changes 2021-10-30 23:14:03.883071308 +0200 +++ /work/SRC/openSUSE:Factory/.chromium.new.1890/chromium.changes 2021-11-03 17:25:43.525319487 +0100 @@ -1,0 +2,12 @@ +Sun Oct 31 07:57:37 UTC 2021 - Andreas Stieger <andreas.stieger(a)gmx.de> + +- Chromium 95.0.4638.69 (boo#1192184): + * CVE-2021-37997: Use after free in Sign-In + * CVE-2021-37998: Use after free in Garbage Collection + * CVE-2021-37999: Insufficient data validation in New Tab Page + * CVE-2021-38000: Insufficient validation of untrusted input in Intents + * CVE-2021-38001: Type Confusion in V8 + * CVE-2021-38002: Use after free in Web Transport + * CVE-2021-38003: Inappropriate implementation in V8 + +------------------------------------------------------------------- Old: ---- chromium-95.0.4638.54.tar.xz New: ---- chromium-95.0.4638.69.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ chromium.spec ++++++ --- /var/tmp/diff_new_pack.Z8txr2/_old 2021-11-03 17:25:49.109322541 +0100 +++ /var/tmp/diff_new_pack.Z8txr2/_new 2021-11-03 17:25:49.113322543 +0100 @@ -47,7 +47,7 @@ %bcond_with lto %bcond_without clang Name: chromium -Version: 95.0.4638.54 +Version: 95.0.4638.69 Release: 0 Summary: Google's open source browser project License: BSD-3-Clause AND LGPL-2.1-or-later ++++++ chromium-95.0.4638.54.tar.xz -> chromium-95.0.4638.69.tar.xz ++++++ /work/SRC/openSUSE:Factory/chromium/chromium-95.0.4638.54.tar.xz /work/SRC/openSUSE:Factory/.chromium.new.1890/chromium-95.0.4638.69.tar.xz differ: char 27, line 1

1 0

commit rav1e for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rav1e for openSUSE:Factory checked in at 2021-11-03 17:25:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rav1e (Old) and /work/SRC/openSUSE:Factory/.rav1e.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "rav1e" Wed Nov 3 17:25:13 2021 rev:11 rq:928388 version:0.5.0 Changes: -------- --- /work/SRC/openSUSE:Factory/rav1e/rav1e.changes 2021-10-04 18:38:54.305954224 +0200 +++ /work/SRC/openSUSE:Factory/.rav1e.new.1890/rav1e.changes 2021-11-03 17:25:18.941306041 +0100 @@ -1,0 +2,7 @@ +Sun Oct 31 14:16:20 UTC 2021 - Andreas Schneider <asn(a)cryptomilk.org> + +- Update to version 0.5.0 + * https://github.com/xiph/rav1e/releases/tag/v0.5.0 +- Removed f553646d70fba8e265d436103a73520eb7adec8c.patch + +------------------------------------------------------------------- Old: ---- f553646d70fba8e265d436103a73520eb7adec8c.patch rav1e-0.4.1.tar.gz New: ---- rav1e-0.5.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rav1e.spec ++++++ --- /var/tmp/diff_new_pack.cLZ2WY/_old 2021-11-03 17:25:20.437306859 +0100 +++ /var/tmp/diff_new_pack.cLZ2WY/_new 2021-11-03 17:25:20.441306862 +0100 @@ -18,7 +18,7 @@ Name: rav1e -Version: 0.4.1 +Version: 0.5.0 Release: 0 Summary: Fastest and safest AV1 encoder License: BSD-2-Clause @@ -31,9 +31,6 @@ Source98: README.suse-maint Source99: baselibs.conf # -# Fix squared artefacts on image when converting to AVIF -Patch0: https://github.com/xiph/rav1e/commit/f553646d70fba8e265d436103a73520eb7adec… -# BuildRequires: cargo-c BuildRequires: cargo-packaging BuildRequires: nasm ++++++ _service ++++++ --- /var/tmp/diff_new_pack.cLZ2WY/_old 2021-11-03 17:25:20.489306888 +0100 +++ /var/tmp/diff_new_pack.cLZ2WY/_new 2021-11-03 17:25:20.489306888 +0100 @@ -1,5 +1,5 @@ <services> <service name="cargo_vendor" mode="disabled"> - <param name="srcdir">rav1e-0.4.1</param> + <param name="srcdir">rav1e-0.5.0</param> </service> </services> ++++++ rav1e-0.4.1.tar.gz -> rav1e-0.5.0.tar.gz ++++++ ++++ 150635 lines of diff (skipped) ++++++ vendor.tar.xz ++++++ /work/SRC/openSUSE:Factory/rav1e/vendor.tar.xz /work/SRC/openSUSE:Factory/.rav1e.new.1890/vendor.tar.xz differ: char 13, line 1

1 0

commit glfw for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package glfw for openSUSE:Factory checked in at 2021-11-03 17:25:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/glfw (Old) and /work/SRC/openSUSE:Factory/.glfw.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "glfw" Wed Nov 3 17:25:13 2021 rev:17 rq:928379 version:3.3.5 Changes: -------- --- /work/SRC/openSUSE:Factory/glfw/glfw.changes 2021-06-18 10:13:25.357965404 +0200 +++ /work/SRC/openSUSE:Factory/.glfw.new.1890/glfw.changes 2021-11-03 17:25:17.785305409 +0100 @@ -1,0 +2,19 @@ +Fri Oct 29 18:55:53 UTC 2021 - Martin Hauke <mardnh(a)gmx.de> + +- Update to version 3.3.5 + * Updated gamepad mappings from upstream. + Bugfixes: + * Buffers were swapped at creation on single-buffered windows. + * Gamepad mapping updates could spam GLFW_INVALID_VALUE due to + incompatible controllers sharing hardware ID. + * Native access functions for context handles did not check that + the API matched. + Bugfixes [X11] + * Changing GLFW_FLOATING could leak memory + Bugfixes [Wayland] + * Some keys were not repeating in Wayland. + * Non-arrow cursors are offset from the hotspot. + Bugfixes [EGL] + * The GLFW_DOUBLEBUFFER context attribute was ignored. + +------------------------------------------------------------------- Old: ---- glfw-3.3.4.tar.gz New: ---- glfw-3.3.5.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ glfw.spec ++++++ --- /var/tmp/diff_new_pack.kSmpId/_old 2021-11-03 17:25:18.253305665 +0100 +++ /var/tmp/diff_new_pack.kSmpId/_new 2021-11-03 17:25:18.257305668 +0100 @@ -24,7 +24,7 @@ %endif %define sover 3 Name: glfw -Version: 3.3.4 +Version: 3.3.5 Release: 0 Summary: Framework for OpenGL application development License: Zlib ++++++ glfw-3.3.4.tar.gz -> glfw-3.3.5.tar.gz ++++++ ++++ 4603 lines of diff (skipped)

1 0

commit kdeconnect-kde for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kdeconnect-kde for openSUSE:Factory checked in at 2021-11-03 17:25:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kdeconnect-kde (Old) and /work/SRC/openSUSE:Factory/.kdeconnect-kde.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "kdeconnect-kde" Wed Nov 3 17:25:12 2021 rev:42 rq:928370 version:21.08.2 Changes: -------- --- /work/SRC/openSUSE:Factory/kdeconnect-kde/kdeconnect-kde.changes 2021-10-13 18:02:46.638963360 +0200 +++ /work/SRC/openSUSE:Factory/.kdeconnect-kde.new.1890/kdeconnect-kde.changes 2021-11-03 17:25:16.841304892 +0100 @@ -1,0 +2,14 @@ +Sun Oct 31 12:09:10 UTC 2021 - Fabian Vogt <fabian(a)ritter-vogt.de> + +- Make sshfs depencency versioned for kdeconnect-openssh-8.8.patch +- Add patch to add back option removed by kdeconnect-openssh-8.8.patch: + * kdeconnect-add-back-ssh-dss.patch + +------------------------------------------------------------------- +Sun Oct 31 08:47:15 UTC 2021 - munix9(a)googlemail.com + +- Add kdeconnect-openssh-8.8.patch (boo#1191886), + (kde#351725) and (kde#443155) + See also https://bugs.archlinux.org/task/72350 + +------------------------------------------------------------------- New: ---- kdeconnect-add-back-ssh-dss.patch kdeconnect-openssh-8.8.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kdeconnect-kde.spec ++++++ --- /var/tmp/diff_new_pack.Rk96mB/_old 2021-11-03 17:25:17.537305274 +0100 +++ /var/tmp/diff_new_pack.Rk96mB/_new 2021-11-03 17:25:17.541305275 +0100 @@ -33,6 +33,9 @@ %endif Source100: kdeconnect-kde.SuSEfirewall Source101: kdeconnect-kde-firewalld.xml +# PATCH-FIX-OPENSUSE kdeconnect-openssh-8.8.patch boo#1191886 +Patch0: https://raw.githubusercontent.com/archlinux/svntogit-packages/packages/kdec… +Patch1: kdeconnect-add-back-ssh-dss.patch BuildRequires: cmake >= 3.0 BuildRequires: extra-cmake-modules BuildRequires: kf5-filesystem @@ -68,7 +71,9 @@ Requires: kirigami2 Requires: libqt5-qtquickcontrols2 Requires: plasma-framework-components -Requires: sshfs +# kdeconnect-openssh-8.8.patch needs https://github.com/libfuse/sshfs/pull/269, +# which is so far only on the way to TW. +Requires: sshfs >= 3.7.2 Recommends: kpeoplevcard Conflicts: kdeconnect-kde4 ++++++ kdeconnect-add-back-ssh-dss.patch ++++++ From: Fabian Vogt <fabian(a)ritter-vogt.de> Subject: Add back HostKeyAlgorithms=+ssh-dsa The previous patch removed the old option, presumably by accident. Also fix the bugref. Index: kdeconnect-kde-21.08.2/plugins/sftp/mounter.cpp =================================================================== --- kdeconnect-kde-21.08.2.orig/plugins/sftp/mounter.cpp +++ kdeconnect-kde-21.08.2/plugins/sftp/mounter.cpp @@ -129,7 +129,8 @@ void Mounter::onPackageReceived(const Ne << QStringLiteral("-o") << QStringLiteral("IdentityFile=") + KdeConnectConfig::instance().privateKeyPath() << QStringLiteral("-o") << QStringLiteral("StrictHostKeyChecking=no") //Do not ask for confirmation because it is not a known host << QStringLiteral("-o") << QStringLiteral("UserKnownHostsFile=/dev/null") //Prevent storing as a known host - << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-rsa") //https://bugs.kde.org/show_bug.cgi?id=351725 + << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-dss") //https://bugs.kde.org/show_bug.cgi?id=351725 + << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-rsa") //https://bugs.kde.org/show_bug.cgi?id=443155 << QStringLiteral("-o") << QStringLiteral("PubkeyAcceptedKeyTypes=+ssh-rsa") << QStringLiteral("-o") << QStringLiteral("uid=") + QString::number(getuid()) << QStringLiteral("-o") << QStringLiteral("gid=") + QString::number(getgid()) ++++++ kdeconnect-openssh-8.8.patch ++++++ diff --git a/plugins/sftp/mounter.cpp b/plugins/sftp/mounter.cpp index 2a484186..23ddc616 100644 --- a/plugins/sftp/mounter.cpp +++ b/plugins/sftp/mounter.cpp @@ -129,7 +129,8 @@ void Mounter::onPackageReceived(const NetworkPacket& np) << QStringLiteral("-o") << QStringLiteral("IdentityFile=") + KdeConnectConfig::instance().privateKeyPath() << QStringLiteral("-o") << QStringLiteral("StrictHostKeyChecking=no") //Do not ask for confirmation because it is not a known host << QStringLiteral("-o") << QStringLiteral("UserKnownHostsFile=/dev/null") //Prevent storing as a known host - << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-dss") //https://bugs.kde.org/show_bug.cgi?id=351725 + << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-rsa") //https://bugs.kde.org/show_bug.cgi?id=351725 + << QStringLiteral("-o") << QStringLiteral("PubkeyAcceptedKeyTypes=+ssh-rsa") << QStringLiteral("-o") << QStringLiteral("uid=") + QString::number(getuid()) << QStringLiteral("-o") << QStringLiteral("gid=") + QString::number(getgid()) << QStringLiteral("-o") << QStringLiteral("reconnect")

1 0

commit python-responses for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-responses for openSUSE:Factory checked in at 2021-11-03 17:25:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-responses (Old) and /work/SRC/openSUSE:Factory/.python-responses.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-responses" Wed Nov 3 17:25:11 2021 rev:16 rq:928317 version:0.15.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-responses/python-responses.changes 2021-05-20 19:23:52.998235694 +0200 +++ /work/SRC/openSUSE:Factory/.python-responses.new.1890/python-responses.changes 2021-11-03 17:25:15.789304318 +0100 @@ -1,0 +2,38 @@ +Sat Oct 30 20:38:16 UTC 2021 - Dirk M��ller <dmueller(a)suse.com> + +- update to 0.15.0: + * Added `responses.PassthroughResponse` and + `reponses.BaseResponse.passthrough`. These features make building passthrough + responses more compatible with dynamcially generated response objects. + * Removed the unused ``_is_redirect()`` function from responses internals. + * Added `responses.matchers.request_kwargs_matcher`. This matcher allows you + to match additional request arguments like `stream`. + * Added `responses.matchers.multipart_matcher`. This matcher allows you + to match request body and headers for ``multipart/form-data`` data + * Added `responses.matchers.query_string_matcher`. This matcher allows you + to match request query string, similar to `responses.matchers.query_param_matcher`. + * Added `responses.matchers.header_matcher()`. This matcher allows you to match + request headers. By default only headers supplied to `header_matcher()` are checked. + You can make header matching exhaustive by passing `strict_match=True` to `header_matcher()`. + * Changed all matchers output message in case of mismatch. Now message is aligned + between Python2 and Python3 versions + * Deprecate ``stream`` argument in ``Response`` and ``CallbackResponse`` + * Added Python 3.10 support + +------------------------------------------------------------------- +Tue Oct 26 20:49:46 UTC 2021 - Dirk M��ller <dmueller(a)suse.com> + +- update to 0.14.0: + * Added `responses.matchers`. + * Moved `responses.json_params_matcher` to `responses.matchers.json_param_matcher` + * Moved `responses.urlencoded_params_matcher` to + `responses.matchers.urlencoded_param_matcher` + * Added `responses.query_params_matcher`. This matcher allows you to match + query strings with a dictionary. + * Added `auto_calculate_content_length` option to `responses.add()`. When + enabled, this option will generate a `Content-Length` header + based on the number of bytes in the response body. + * Improve typing support + * Use URLs with normalized hostnames when comparing URLs. + +------------------------------------------------------------------- Old: ---- responses-0.13.3.tar.gz New: ---- responses-0.15.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-responses.spec ++++++ --- /var/tmp/diff_new_pack.jTbEEW/_old 2021-11-03 17:25:16.289304591 +0100 +++ /var/tmp/diff_new_pack.jTbEEW/_new 2021-11-03 17:25:16.289304591 +0100 @@ -18,7 +18,7 @@ %{?!python_module:%define python_module() python-%{**} python3-%{**}} Name: python-responses -Version: 0.13.3 +Version: 0.15.0 Release: 0 Summary: A utility library for mocking out the `requests` Python library License: Apache-2.0 ++++++ responses-0.13.3.tar.gz -> responses-0.15.0.tar.gz ++++++ ++++ 4654 lines of diff (skipped)

1 0

commit python-urllib3 for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-urllib3 for openSUSE:Factory checked in at 2021-11-03 17:25:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-urllib3 (Old) and /work/SRC/openSUSE:Factory/.python-urllib3.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-urllib3" Wed Nov 3 17:25:10 2021 rev:48 rq:928316 version:1.26.7 Changes: -------- --- /work/SRC/openSUSE:Factory/python-urllib3/python-urllib3.changes 2021-07-16 22:13:20.054579173 +0200 +++ /work/SRC/openSUSE:Factory/.python-urllib3.new.1890/python-urllib3.changes 2021-11-03 17:25:14.925303845 +0100 @@ -1,0 +2,9 @@ +Tue Oct 26 21:02:38 UTC 2021 - Dirk M��ller <dmueller(a)suse.com> + +- update to 1.26.7: + * Fixed a bug with HTTPS hostname verification involving IP addresses and lack + of SNI. + * Fixed a bug where IPv6 braces weren't stripped during certificate hostname + matching. + +------------------------------------------------------------------- Old: ---- urllib3-1.26.6.tar.gz New: ---- urllib3-1.26.7.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-urllib3.spec ++++++ --- /var/tmp/diff_new_pack.oRgeki/_old 2021-11-03 17:25:15.537304180 +0100 +++ /var/tmp/diff_new_pack.oRgeki/_new 2021-11-03 17:25:15.537304180 +0100 @@ -27,7 +27,7 @@ %bcond_with test %endif Name: python-urllib3%{psuffix} -Version: 1.26.6 +Version: 1.26.7 Release: 0 Summary: HTTP library with thread-safe connection pooling, file post, and more License: MIT ++++++ urllib3-1.26.6.tar.gz -> urllib3-1.26.7.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/CHANGES.rst new/urllib3-1.26.7/CHANGES.rst --- old/urllib3-1.26.6/CHANGES.rst 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/CHANGES.rst 2021-09-22 20:00:21.000000000 +0200 @@ -1,6 +1,14 @@ Changes ======= +1.26.7 (2021-09-22) +------------------- +* Fixed a bug with HTTPS hostname verification involving IP addresses and lack + of SNI. (Issue #2400) +* Fixed a bug where IPv6 braces weren't stripped during certificate hostname + matching. (Issue #2240) + + 1.26.6 (2021-06-25) ------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/PKG-INFO new/urllib3-1.26.7/PKG-INFO --- old/urllib3-1.26.6/PKG-INFO 2021-06-25 15:20:57.968305300 +0200 +++ new/urllib3-1.26.7/PKG-INFO 2021-09-22 20:00:56.037445500 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.1 Name: urllib3 -Version: 1.26.6 +Version: 1.26.7 Summary: HTTP library with thread-safe connection pooling, file post, and more. Home-page: https://urllib3.readthedocs.io/ Author: Andrey Petrov @@ -143,6 +143,14 @@ Changes ======= +1.26.7 (2021-09-22) +------------------- +* Fixed a bug with HTTPS hostname verification involving IP addresses and lack + of SNI. (Issue #2400) +* Fixed a bug where IPv6 braces weren't stripped during certificate hostname + matching. (Issue #2240) + + 1.26.6 (2021-06-25) ------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/src/urllib3/_version.py new/urllib3-1.26.7/src/urllib3/_version.py --- old/urllib3-1.26.6/src/urllib3/_version.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/src/urllib3/_version.py 2021-09-22 20:00:21.000000000 +0200 @@ -1,2 +1,2 @@ # This file is protected via CODEOWNERS -__version__ = "1.26.6" +__version__ = "1.26.7" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/src/urllib3/connection.py new/urllib3-1.26.7/src/urllib3/connection.py --- old/urllib3-1.26.6/src/urllib3/connection.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/src/urllib3/connection.py 2021-09-22 20:00:21.000000000 +0200 @@ -56,6 +56,7 @@ from .util.ssl_ import ( assert_fingerprint, create_urllib3_context, + is_ipaddress, resolve_cert_reqs, resolve_ssl_version, ssl_wrap_socket, @@ -107,6 +108,10 @@ #: Whether this connection verifies the host's certificate. is_verified = False + #: Whether this proxy connection (if used) verifies the proxy host's + #: certificate. + proxy_is_verified = None + def __init__(self, *args, **kw): if not six.PY2: kw.pop("strict", None) @@ -490,14 +495,10 @@ self.ca_cert_dir, self.ca_cert_data, ) - # By default urllib3's SSLContext disables `check_hostname` and uses - # a custom check. For proxies we're good with relying on the default - # verification. - ssl_context.check_hostname = True # If no cert was provided, use only the default options for server # certificate validation - return ssl_wrap_socket( + socket = ssl_wrap_socket( sock=conn, ca_certs=self.ca_certs, ca_cert_dir=self.ca_cert_dir, @@ -506,8 +507,37 @@ ssl_context=ssl_context, ) + if ssl_context.verify_mode != ssl.CERT_NONE and not getattr( + ssl_context, "check_hostname", False + ): + # While urllib3 attempts to always turn off hostname matching from + # the TLS library, this cannot always be done. So we check whether + # the TLS Library still thinks it's matching hostnames. + cert = socket.getpeercert() + if not cert.get("subjectAltName", ()): + warnings.warn( + ( + "Certificate for {0} has no `subjectAltName`, falling back to check for a " + "`commonName` for now. This feature is being removed by major browsers and " + "deprecated by RFC 2818. (See https://github.com/urllib3/urllib3/issues/497 " + "for details.)".format(hostname) + ), + SubjectAltNameWarning, + ) + _match_hostname(cert, hostname) + + self.proxy_is_verified = ssl_context.verify_mode == ssl.CERT_REQUIRED + return socket + def _match_hostname(cert, asserted_hostname): + # Our upstream implementation of ssl.match_hostname() + # only applies this normalization to IP addresses so it doesn't + # match DNS SANs so we do the same thing! + stripped_hostname = asserted_hostname.strip("u[]") + if is_ipaddress(stripped_hostname): + asserted_hostname = stripped_hostname + try: match_hostname(cert, asserted_hostname) except CertificateError as e: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/src/urllib3/connectionpool.py new/urllib3-1.26.7/src/urllib3/connectionpool.py --- old/urllib3-1.26.6/src/urllib3/connectionpool.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/src/urllib3/connectionpool.py 2021-09-22 20:00:21.000000000 +0200 @@ -1020,6 +1020,17 @@ InsecureRequestWarning, ) + if getattr(conn, "proxy_is_verified", None) is False: + warnings.warn( + ( + "Unverified HTTPS connection done to an HTTPS proxy. " + "Adding certificate verification is strongly advised. See: " + "https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html" + "#ssl-warnings" + ), + InsecureRequestWarning, + ) + def connection_from_url(url, **kw): """ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/src/urllib3/contrib/_securetransport/low_level.py new/urllib3-1.26.7/src/urllib3/contrib/_securetransport/low_level.py --- old/urllib3-1.26.6/src/urllib3/contrib/_securetransport/low_level.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/src/urllib3/contrib/_securetransport/low_level.py 2021-09-22 20:00:21.000000000 +0200 @@ -188,6 +188,7 @@ # We only want to do that if an error occurs: otherwise, the caller # should free. CoreFoundation.CFRelease(cert_array) + raise return cert_array diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/src/urllib3/util/proxy.py new/urllib3-1.26.7/src/urllib3/util/proxy.py --- old/urllib3-1.26.6/src/urllib3/util/proxy.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/src/urllib3/util/proxy.py 2021-09-22 20:00:21.000000000 +0200 @@ -45,6 +45,7 @@ ssl_version=resolve_ssl_version(ssl_version), cert_reqs=resolve_cert_reqs(cert_reqs), ) + if ( not ca_certs and not ca_cert_dir diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/src/urllib3.egg-info/PKG-INFO new/urllib3-1.26.7/src/urllib3.egg-info/PKG-INFO --- old/urllib3-1.26.6/src/urllib3.egg-info/PKG-INFO 2021-06-25 15:20:57.000000000 +0200 +++ new/urllib3-1.26.7/src/urllib3.egg-info/PKG-INFO 2021-09-22 20:00:55.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.1 Name: urllib3 -Version: 1.26.6 +Version: 1.26.7 Summary: HTTP library with thread-safe connection pooling, file post, and more. Home-page: https://urllib3.readthedocs.io/ Author: Andrey Petrov @@ -143,6 +143,14 @@ Changes ======= +1.26.7 (2021-09-22) +------------------- +* Fixed a bug with HTTPS hostname verification involving IP addresses and lack + of SNI. (Issue #2400) +* Fixed a bug where IPv6 braces weren't stripped during certificate hostname + matching. (Issue #2240) + + 1.26.6 (2021-06-25) ------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/test/conftest.py new/urllib3-1.26.7/test/conftest.py --- old/urllib3-1.26.6/test/conftest.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/test/conftest.py 2021-09-22 20:00:21.000000000 +0200 @@ -11,6 +11,7 @@ from tornado import ioloop, web from dummyserver.handlers import TestingApp +from dummyserver.proxy import ProxyHandler from dummyserver.server import HAS_IPV6, run_tornado_app from dummyserver.testcase import HTTPSDummyServerTestCase from urllib3.util import ssl_ @@ -30,16 +31,21 @@ ServerConfig = collections.namedtuple("ServerConfig", ["host", "port", "ca_certs"]) +def _write_cert_to_dir(cert, tmpdir, file_prefix="server"): + cert_path = str(tmpdir / ("%s.pem" % file_prefix)) + key_path = str(tmpdir / ("%s.key" % file_prefix)) + cert.private_key_pem.write_to_path(key_path) + cert.cert_chain_pems[0].write_to_path(cert_path) + certs = {"keyfile": key_path, "certfile": cert_path} + return certs + + @contextlib.contextmanager def run_server_in_thread(scheme, host, tmpdir, ca, server_cert): ca_cert_path = str(tmpdir / "ca.pem") - server_cert_path = str(tmpdir / "server.pem") - server_key_path = str(tmpdir / "server.key") ca.cert_pem.write_to_path(ca_cert_path) - server_cert.private_key_pem.write_to_path(server_key_path) - server_cert.cert_chain_pems[0].write_to_path(server_cert_path) - server_certs = {"keyfile": server_key_path, "certfile": server_cert_path} + server_certs = _write_cert_to_dir(server_cert, tmpdir) io_loop = ioloop.IOLoop.current() app = web.Application([(r".*", TestingApp)]) server, port = run_tornado_app(app, io_loop, server_certs, scheme, host) @@ -53,6 +59,39 @@ server_thread.join() +(a)contextlib.contextmanager +def run_server_and_proxy_in_thread( + proxy_scheme, proxy_host, tmpdir, ca, proxy_cert, server_cert +): + ca_cert_path = str(tmpdir / "ca.pem") + ca.cert_pem.write_to_path(ca_cert_path) + + server_certs = _write_cert_to_dir(server_cert, tmpdir) + proxy_certs = _write_cert_to_dir(proxy_cert, tmpdir, "proxy") + + io_loop = ioloop.IOLoop.current() + server = web.Application([(r".*", TestingApp)]) + server, port = run_tornado_app(server, io_loop, server_certs, "https", "localhost") + server_config = ServerConfig("localhost", port, ca_cert_path) + + proxy = web.Application([(r".*", ProxyHandler)]) + proxy_app, proxy_port = run_tornado_app( + proxy, io_loop, proxy_certs, proxy_scheme, proxy_host + ) + proxy_config = ServerConfig(proxy_host, proxy_port, ca_cert_path) + + server_thread = threading.Thread(target=io_loop.start) + server_thread.start() + + yield (proxy_config, server_config) + + io_loop.add_callback(server.stop) + io_loop.add_callback(proxy_app.stop) + io_loop.add_callback(io_loop.stop) + + server_thread.join() + + @pytest.fixture def no_san_server(tmp_path_factory): tmpdir = tmp_path_factory.mktemp("certs") @@ -65,6 +104,20 @@ @pytest.fixture +def no_san_proxy(tmp_path_factory): + tmpdir = tmp_path_factory.mktemp("certs") + ca = trustme.CA() + # only common name, no subject alternative names + proxy_cert = ca.issue_cert(common_name=u"localhost") + server_cert = ca.issue_cert(u"localhost") + + with run_server_and_proxy_in_thread( + "https", "localhost", tmpdir, ca, proxy_cert, server_cert + ) as cfg: + yield cfg + + +(a)pytest.fixture def no_localhost_san_server(tmp_path_factory): tmpdir = tmp_path_factory.mktemp("certs") ca = trustme.CA() @@ -76,7 +129,37 @@ @pytest.fixture -def ip_san_server(tmp_path_factory): +def ipv4_san_proxy(tmp_path_factory): + tmpdir = tmp_path_factory.mktemp("certs") + ca = trustme.CA() + # IP address in Subject Alternative Name + proxy_cert = ca.issue_cert(u"127.0.0.1") + + server_cert = ca.issue_cert(u"localhost") + + with run_server_and_proxy_in_thread( + "https", "127.0.0.1", tmpdir, ca, proxy_cert, server_cert + ) as cfg: + yield cfg + + +(a)pytest.fixture +def ipv6_san_proxy(tmp_path_factory): + tmpdir = tmp_path_factory.mktemp("certs") + ca = trustme.CA() + # IP addresses in Subject Alternative Name + proxy_cert = ca.issue_cert(u"::1") + + server_cert = ca.issue_cert(u"localhost") + + with run_server_and_proxy_in_thread( + "https", "::1", tmpdir, ca, proxy_cert, server_cert + ) as cfg: + yield cfg + + +(a)pytest.fixture +def ipv4_san_server(tmp_path_factory): tmpdir = tmp_path_factory.mktemp("certs") ca = trustme.CA() # IP address in Subject Alternative Name diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/test/contrib/test_pyopenssl.py new/urllib3-1.26.7/test/contrib/test_pyopenssl.py --- old/urllib3-1.26.6/test/contrib/test_pyopenssl.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/test/contrib/test_pyopenssl.py 2021-09-22 20:00:21.000000000 +0200 @@ -34,7 +34,7 @@ from ..test_util import TestUtilSSL # noqa: E402, F401 from ..with_dummyserver.test_https import ( # noqa: E402, F401 TestHTTPS, - TestHTTPS_IPSAN, + TestHTTPS_IPV4SAN, TestHTTPS_IPv6Addr, TestHTTPS_IPV6SAN, TestHTTPS_NoSAN, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/test/contrib/test_securetransport.py new/urllib3-1.26.7/test/contrib/test_securetransport.py --- old/urllib3-1.26.6/test/contrib/test_securetransport.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/test/contrib/test_securetransport.py 2021-09-22 20:00:21.000000000 +0200 @@ -1,4 +1,5 @@ # -*- coding: utf-8 -*- +import base64 import contextlib import socket import ssl @@ -52,3 +53,15 @@ ws = WrappedSocket(s) with pytest.raises(ssl.SSLError): ws._custom_validate(True, b"") + + +def test_no_crash_with_invalid_trust_bundle(): + invalid_cert = base64.b64encode(b"invalid-cert") + cert_bundle = ( + b"-----BEGIN CERTIFICATE-----\n" + invalid_cert + b"\n-----END CERTIFICATE-----" + ) + + with contextlib.closing(socket.socket()) as s: + ws = WrappedSocket(s) + with pytest.raises(ssl.SSLError): + ws._custom_validate(True, cert_bundle) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/test/test_connection.py new/urllib3-1.26.7/test/test_connection.py --- old/urllib3-1.26.6/test/test_connection.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/test/test_connection.py 2021-09-22 20:00:21.000000000 +0200 @@ -43,6 +43,42 @@ ) assert e._peer_cert == cert + def test_match_hostname_ip_address_ipv6(self): + cert = {"subjectAltName": (("IP Address", "1:2::2:1"),)} + asserted_hostname = "1:2::2:2" + try: + with mock.patch("urllib3.connection.log.warning") as mock_log: + _match_hostname(cert, asserted_hostname) + except CertificateError as e: + assert "hostname '1:2::2:2' doesn't match '1:2::2:1'" in str(e) + mock_log.assert_called_once_with( + "Certificate did not match expected hostname: %s. Certificate: %s", + "1:2::2:2", + {"subjectAltName": (("IP Address", "1:2::2:1"),)}, + ) + assert e._peer_cert == cert + + def test_match_hostname_dns_with_brackets_doesnt_match(self): + cert = { + "subjectAltName": ( + ("DNS", "localhost"), + ("IP Address", "localhost"), + ) + } + asserted_hostname = "[localhost]" + with pytest.raises(CertificateError) as e: + _match_hostname(cert, asserted_hostname) + assert ( + "hostname '[localhost]' doesn't match either of 'localhost', 'localhost'" + in str(e.value) + ) + + def test_match_hostname_ip_address_ipv6_brackets(self): + cert = {"subjectAltName": (("IP Address", "1:2::2:1"),)} + asserted_hostname = "[1:2::2:1]" + # Assert no error is raised + _match_hostname(cert, asserted_hostname) + def test_recent_date(self): # This test is to make sure that the RECENT_DATE value # doesn't get too far behind what the current date is. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/test/with_dummyserver/test_https.py new/urllib3-1.26.7/test/with_dummyserver/test_https.py --- old/urllib3-1.26.6/test/with_dummyserver/test_https.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/test/with_dummyserver/test_https.py 2021-09-22 20:00:21.000000000 +0200 @@ -859,29 +859,25 @@ assert warn.called -class TestHTTPS_IPSAN: - def test_can_validate_ip_san(self, ip_san_server): +class TestHTTPS_IPV4SAN: + def test_can_validate_ip_san(self, ipv4_san_server): """Ensure that urllib3 can validate SANs with IP addresses in them.""" - try: - import ipaddress # noqa: F401 - except ImportError: - pytest.skip("Only runs on systems with an ipaddress module") - with HTTPSConnectionPool( - ip_san_server.host, - ip_san_server.port, + ipv4_san_server.host, + ipv4_san_server.port, cert_reqs="CERT_REQUIRED", - ca_certs=ip_san_server.ca_certs, + ca_certs=ipv4_san_server.ca_certs, ) as https_pool: r = https_pool.request("GET", "/") assert r.status == 200 class TestHTTPS_IPv6Addr: - def test_strip_square_brackets_before_validating(self, ipv6_addr_server): + @pytest.mark.parametrize("host", ["::1", "[::1]"]) + def test_strip_square_brackets_before_validating(self, ipv6_addr_server, host): """Test that the fix for #760 works.""" with HTTPSConnectionPool( - "[::1]", + host, ipv6_addr_server.port, cert_reqs="CERT_REQUIRED", ca_certs=ipv6_addr_server.ca_certs, @@ -891,15 +887,11 @@ class TestHTTPS_IPV6SAN: - def test_can_validate_ipv6_san(self, ipv6_san_server): + @pytest.mark.parametrize("host", ["::1", "[::1]"]) + def test_can_validate_ipv6_san(self, ipv6_san_server, host): """Ensure that urllib3 can validate SANs with IPv6 addresses in them.""" - try: - import ipaddress # noqa: F401 - except ImportError: - pytest.skip("Only runs on systems with an ipaddress module") - with HTTPSConnectionPool( - "[::1]", + host, ipv6_san_server.port, cert_reqs="CERT_REQUIRED", ca_certs=ipv6_san_server.ca_certs, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/urllib3-1.26.6/test/with_dummyserver/test_proxy_poolmanager.py new/urllib3-1.26.7/test/with_dummyserver/test_proxy_poolmanager.py --- old/urllib3-1.26.6/test/with_dummyserver/test_proxy_poolmanager.py 2021-06-25 15:20:25.000000000 +0200 +++ new/urllib3-1.26.7/test/with_dummyserver/test_proxy_poolmanager.py 2021-09-22 20:00:21.000000000 +0200 @@ -3,6 +3,7 @@ import shutil import socket import tempfile +import warnings from test import ( LONG_TIMEOUT, SHORT_TIMEOUT, @@ -21,11 +22,13 @@ from urllib3.connectionpool import VerifiedHTTPSConnection, connection_from_url from urllib3.exceptions import ( ConnectTimeoutError, + InsecureRequestWarning, MaxRetryError, ProxyError, ProxySchemeUnknown, ProxySchemeUnsupported, SSLError, + SubjectAltNameWarning, ) from urllib3.poolmanager import ProxyManager, proxy_from_url from urllib3.util.ssl_ import create_urllib3_context @@ -213,6 +216,24 @@ assert isinstance(e.value.reason, SSLError) assert "doesn't match" in str(e.value.reason) + @onlyPy3 + def test_proxy_verified_warning(self): + """Skip proxy verification to validate warnings are generated""" + with warnings.catch_warnings(record=True) as w: + with proxy_from_url(self.https_proxy_url, cert_reqs="NONE") as https: + r = https.request("GET", "%s/" % self.https_url) + assert r.status == 200 + assert len(w) == 2 # We expect two warnings (proxy, destination) + assert w[0].category == InsecureRequestWarning + assert w[1].category == InsecureRequestWarning + messages = set(str(x.message) for x in w) + expected = [ + "Unverified HTTPS request is being made to host 'localhost'", + "Unverified HTTPS connection done to an HTTPS proxy.", + ] + for warn_message in expected: + assert [msg for msg in messages if warn_message in expected] + def test_redirect(self): with proxy_from_url(self.proxy_url) as http: r = http.request( @@ -565,3 +586,35 @@ assert "hostname 'localhost' doesn't match" in str( e.value.reason ) or "Hostname mismatch" in str(e.value.reason) + + @onlyPy3 + def test_https_proxy_ipv4_san(self, ipv4_san_proxy): + proxy, server = ipv4_san_proxy + proxy_url = "https://%s:%s" % (proxy.host, proxy.port) + destination_url = "https://%s:%s" % (server.host, server.port) + with proxy_from_url(proxy_url, ca_certs=proxy.ca_certs) as https: + r = https.request("GET", destination_url) + assert r.status == 200 + + @onlyPy3 + def test_https_proxy_ipv6_san(self, ipv6_san_proxy): + proxy, server = ipv6_san_proxy + proxy_url = "https://[%s]:%s" % (proxy.host, proxy.port) + destination_url = "https://%s:%s" % (server.host, server.port) + with proxy_from_url(proxy_url, ca_certs=proxy.ca_certs) as https: + r = https.request("GET", destination_url) + assert r.status == 200 + + @onlyPy3 + def test_https_proxy_common_name_warning(self, no_san_proxy): + proxy, server = no_san_proxy + proxy_url = "https://%s:%s" % (proxy.host, proxy.port) + destination_url = "https://%s:%s" % (server.host, server.port) + + with warnings.catch_warnings(record=True) as w: + with proxy_from_url(proxy_url, ca_certs=proxy.ca_certs) as https: + r = https.request("GET", destination_url) + assert r.status == 200 + + assert len(w) == 1 + assert w[0].category == SubjectAltNameWarning

1 0

commit rpm for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rpm for openSUSE:Factory checked in at 2021-11-03 17:25:09 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpm (Old) and /work/SRC/openSUSE:Factory/.rpm.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "rpm" Wed Nov 3 17:25:09 2021 rev:292 rq:928134 version:4.17.0 Changes: -------- --- /work/SRC/openSUSE:Factory/rpm/rpm.changes 2021-10-25 15:16:45.257650156 +0200 +++ /work/SRC/openSUSE:Factory/.rpm.new.1890/rpm.changes 2021-11-03 17:25:12.737302648 +0100 @@ -1,0 +2,8 @@ +Thu Oct 14 18:16:22 CEST 2021 - mls(a)suse.de + +- Add support for using a thread pool for threaded zstd compression + new patch: zstdpool.diff +- Switch to threaded zstd compression with a pool of 8 threads + new patch: zstdthreaded.diff + +------------------------------------------------------------------- New: ---- zstdpool.diff zstdthreaded.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rpm.spec ++++++ --- /var/tmp/diff_new_pack.N27Ccl/_old 2021-11-03 17:25:13.961303317 +0100 +++ /var/tmp/diff_new_pack.N27Ccl/_new 2021-11-03 17:25:13.965303320 +0100 @@ -115,6 +115,8 @@ Patch123: nextiteratorheaderblob.diff Patch131: posttrans.diff Patch132: verbosearg.diff +Patch133: zstdpool.diff +Patch134: zstdthreaded.diff Patch200: finddebuginfo.diff Patch201: finddebuginfo-absolute-links.diff Patch202: debugsubpkg.diff @@ -242,7 +244,7 @@ %patch -P 93 -P 94 -P 99 %patch -P 100 -P 102 -P 103 %patch -P 117 -%patch -P 122 -P 123 -P 131 -P 132 +%patch -P 122 -P 123 -P 131 -P 132 -P 133 -P 134 # debugedit patches pushd debugedit-5.0 ++++++ zstdpool.diff ++++++ --- ./rpmio/rpmio.c.orig 2021-10-14 12:34:22.865316722 +0000 +++ ./rpmio/rpmio.c 2021-10-14 13:37:56.835119919 +0000 @@ -8,6 +8,7 @@ #include <ctype.h> #include <dirent.h> #include <fcntl.h> +#include <pthread.h> #if defined(__linux__) #include <sys/personality.h> #endif @@ -1034,6 +1035,7 @@ static const FDIO_t lzdio = &lzdio_s; /* Support for ZSTD library. */ #ifdef HAVE_ZSTD +#define ZSTD_STATIC_LINKING_ONLY #include <zstd.h> typedef struct rpmzstd_s { @@ -1048,6 +1050,27 @@ typedef struct rpmzstd_s { ZSTD_outBuffer zob; /*!< ZSTD_outBuffer */ } * rpmzstd; +#if ZSTD_VERSION_NUMBER >= 10407 + +static pthread_once_t zstdThreadPoolCreated = PTHREAD_ONCE_INIT; +static ZSTD_threadPool *zstdThreadPool; + +static void zstdCreateThreadPool(void) +{ + int numthreads = rpmExpandNumeric("%{?_zstd_pool_threads}%{?!_zstd_pool_threads:-1}"); + if (numthreads >= 0) + numthreads = get_compression_threads(numthreads > 0 ? numthreads : -1); + if (numthreads > 0) { + zstdThreadPool = ZSTD_createThreadPool(numthreads); + if (!zstdThreadPool) + rpmlog(RPMLOG_WARNING, "Could not create zstd thread pool for %d threads\n", numthreads); + else + rpmlog(RPMLOG_DEBUG, "Created zstd thread pool for %d threads\n", numthreads); + } +} + +#endif + static rpmzstd rpmzstdNew(int fdno, const char *fmode) { int flags = 0; @@ -1133,8 +1156,15 @@ static rpmzstd rpmzstdNew(int fdno, cons threads = get_compression_threads(threads); if (threads > 0) { - if (ZSTD_isError (ZSTD_CCtx_setParameter(_stream, ZSTD_c_nbWorkers, threads))) + if (ZSTD_isError (ZSTD_CCtx_setParameter(_stream, ZSTD_c_nbWorkers, threads))) { rpmlog(RPMLOG_DEBUG, "zstd library does not support multi-threading\n"); + } else { +#if ZSTD_VERSION_NUMBER >= 10407 + pthread_once(&zstdThreadPoolCreated, zstdCreateThreadPool); + if (zstdThreadPool) + ZSTD_CCtx_refThreadPool(_stream, zstdThreadPool); +#endif + } } nb = ZSTD_CStreamOutSize(); ++++++ zstdthreaded.diff ++++++ --- macros.in.orig 2021-10-15 07:40:15.601628187 +0000 +++ macros.in 2021-10-15 07:42:23.557282503 +0000 @@ -374,7 +374,10 @@ package or when debugging this package.\ # "w.ufdio" uncompressed # #%_source_payload w9.gzdio -%_binary_payload w19.zstdio +%_binary_payload w19T0.zstdio + +# use a pool with 8 threads for threaded zstd compression +%_zstd_pool_threads 8 # Algorithm to use for generating file checksum digests on build. # If not specified or 0, MD5 is used.

1 0

commit deltarpm for openSUSE:Factory
by Source-Sync 03 Nov '21

03 Nov '21

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package deltarpm for openSUSE:Factory checked in at 2021-11-03 17:25:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/deltarpm (Old) and /work/SRC/openSUSE:Factory/.deltarpm.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "deltarpm" Wed Nov 3 17:25:08 2021 rev:31 rq:928133 version:3.6.3 Changes: -------- --- /work/SRC/openSUSE:Factory/deltarpm/deltarpm.changes 2019-07-13 13:34:00.023342155 +0200 +++ /work/SRC/openSUSE:Factory/.deltarpm.new.1890/deltarpm.changes 2021-11-03 17:25:11.805302138 +0100 @@ -0,0 +1,5 @@ +Fri Oct 29 15:09:47 CEST 2021 - mls(a)suse.de + +- update to deltarpm-3.6.3 + * support for threaded zstd compression + Old: ---- deltarpm-3.6.2.tar.bz2 New: ---- deltarpm-3.6.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ deltarpm.spec ++++++ --- /var/tmp/diff_new_pack.OJtm2R/_old 2021-11-03 17:25:12.349302436 +0100 +++ /var/tmp/diff_new_pack.OJtm2R/_new 2021-11-03 17:25:12.357302440 +0100 @@ -1,7 +1,7 @@ # # spec file for package deltarpm # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2021 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,7 +12,7 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # @@ -21,13 +21,13 @@ # we need to build against recent rpm, so avoid the new payload %define _binary_payload w9.bzdio Name: deltarpm -Version: 3.6.2 +Version: 3.6.3 Release: 0 Summary: Tools to Create and Apply deltarpms License: BSD-3-Clause Group: System/Packages Url: https://github.com/rpm-software-management/deltarpm/ -Source: deltarpm-3.6.2.tar.bz2 +Source: deltarpm-3.6.3.tar.gz BuildRequires: libbz2-devel %if %{with python2} BuildRequires: python2-devel

1 0