packages/python-pip
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: packages:1fc7922296709755522822994d14288325113fe8
Branches Tags
packages:main
..
compare: packages:5ee538ab4420f876982b1176a1e5b7e5c0b54abe
Branches Tags
packages:main

No commits in common. "1fc7922296709755522822994d14288325113fe8" and "5ee538ab4420f876982b1176a1e5b7e5c0b54abe" have entirely different histories.
1fc7922296 ... 5ee538ab44

11 changed files with 10 additions and 7053 deletions
Show Stats Expand all files Collapse all files

2351
backport-0001-CVE-2024-3651.patch
View File

File diff suppressed because it is too large Load Diff

32
backport-0002-CVE-2024-3651.patch
View File

@ -1,32 +0,0 @@
From f50df5120f3584c3375f1a42e413826fe9411a53 Mon Sep 17 00:00:00 2001
From: Kim Davies <kim.davies@iana.org>
Date: Sun, 3 Oct 2021 07:45:11 -0700
Subject: [PATCH] Raise IDNAError on non-ASCII A-Label (fixes #108)
Reference:https://github.com/kjd/idna/commit/f50df5120f3584c3375f1a42e413826fe9411a53
Conflict:NA
---
src/pip/_vendor/idna/core.py | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/pip/_vendor/idna/core.py b/src/pip/_vendor/idna/core.py
index d605129..871ebd3 100644
--- a/src/pip/_vendor/idna/core.py
+++ b/src/pip/_vendor/idna/core.py
@@ -383,8 +383,11 @@ def encode(s, strict=False, uts46=False, std3_rules=False, transitional=False):
def decode(s, strict=False, uts46=False, std3_rules=False):
# type: (Union[str, bytes, bytearray], bool, bool, bool) -> str
- if isinstance(s, (bytes, bytearray)):
- s = s.decode('ascii')
+ try:
+ if isinstance(s, (bytes, bytearray)):
+ s = s.decode('ascii')
+ except UnicodeDecodeError:
+ raise IDNAError('Invalid ASCII in A-label')
if uts46:
s = uts46_remap(s, std3_rules, False)
trailing_dot = False

1104
backport-0003-CVE-2024-3651.patch
View File

File diff suppressed because it is too large Load Diff

899
backport-0004-CVE-2024-3651.patch
View File

@ -1,899 +0,0 @@
From 527fa86d555490f13fda85133e8fe3a918f8bece Mon Sep 17 00:00:00 2001
From: Kim Davies <kim.davies@iana.org>
Date: Tue, 13 Sep 2022 09:30:44 +0800
Subject: [PATCH] Update to Unicode 15
Reference:https://github.com/kjd/idna/commit/527fa86d555490f13fda85133e8fe3a918f8bece
Conflict:NA
---
src/pip/_vendor/idna/idnadata.py | 34 +++-
src/pip/_vendor/idna/uts46data.py | 306 +++++++++++++++++++-----------
2 files changed, 221 insertions(+), 119 deletions(-)
diff --git a/src/pip/_vendor/idna/idnadata.py b/src/pip/_vendor/idna/idnadata.py
index 1b5805d..67db462 100644
--- a/src/pip/_vendor/idna/idnadata.py
+++ b/src/pip/_vendor/idna/idnadata.py
@@ -1,6 +1,6 @@
# This file is automatically generated by tools/idna-data
-__version__ = '14.0.0'
+__version__ = '15.0.0'
scripts = {
'Greek': (
0x37000000374,
@@ -55,12 +55,13 @@ scripts = {
0x16fe200016fe4,
0x16ff000016ff2,
0x200000002a6e0,
- 0x2a7000002b739,
+ 0x2a7000002b73a,
0x2b7400002b81e,
0x2b8200002cea2,
0x2ceb00002ebe1,
0x2f8000002fa1e,
0x300000003134b,
+ 0x31350000323b0,
),
'Hebrew': (
0x591000005c8,
@@ -77,6 +78,7 @@ scripts = {
0x304100003097,
0x309d000030a0,
0x1b0010001b120,
+ 0x1b1320001b133,
0x1b1500001b153,
0x1f2000001f201,
),
@@ -93,6 +95,7 @@ scripts = {
0x1affd0001afff,
0x1b0000001b001,
0x1b1200001b123,
+ 0x1b1550001b156,
0x1b1640001b168,
),
}
@@ -1331,7 +1334,7 @@ codepoint_classes = {
0xcdd00000cdf,
0xce000000ce4,
0xce600000cf0,
- 0xcf100000cf3,
+ 0xcf100000cf4,
0xd0000000d0d,
0xd0e00000d11,
0xd1200000d45,
@@ -1366,7 +1369,7 @@ codepoint_classes = {
0xeb400000ebe,
0xec000000ec5,
0xec600000ec7,
- 0xec800000ece,
+ 0xec800000ecf,
0xed000000eda,
0xede00000ee0,
0xf0000000f01,
@@ -1859,7 +1862,7 @@ codepoint_classes = {
0xab200000ab27,
0xab280000ab2f,
0xab300000ab5b,
- 0xab600000ab6a,
+ 0xab600000ab69,
0xabc00000abeb,
0xabec0000abee,
0xabf00000abfa,
@@ -1943,7 +1946,7 @@ codepoint_classes = {
0x10e8000010eaa,
0x10eab00010ead,
0x10eb000010eb2,
- 0x10f0000010f1d,
+ 0x10efd00010f1d,
0x10f2700010f28,
0x10f3000010f51,
0x10f7000010f86,
@@ -1966,7 +1969,7 @@ codepoint_classes = {
0x111dc000111dd,
0x1120000011212,
0x1121300011238,
- 0x1123e0001123f,
+ 0x1123e00011242,
0x1128000011287,
0x1128800011289,
0x1128a0001128e,
@@ -2047,11 +2050,16 @@ codepoint_classes = {
0x11d9300011d99,
0x11da000011daa,
0x11ee000011ef7,
+ 0x11f0000011f11,
+ 0x11f1200011f3b,
+ 0x11f3e00011f43,
+ 0x11f5000011f5a,
0x11fb000011fb1,
0x120000001239a,
0x1248000012544,
0x12f9000012ff1,
- 0x130000001342f,
+ 0x1300000013430,
+ 0x1344000013456,
0x1440000014647,
0x1680000016a39,
0x16a4000016a5f,
@@ -2079,7 +2087,9 @@ codepoint_classes = {
0x1aff50001affc,
0x1affd0001afff,
0x1b0000001b123,
+ 0x1b1320001b133,
0x1b1500001b153,
+ 0x1b1550001b156,
0x1b1640001b168,
0x1b1700001b2fc,
0x1bc000001bc6b,
@@ -2096,17 +2106,21 @@ codepoint_classes = {
0x1da9b0001daa0,
0x1daa10001dab0,
0x1df000001df1f,
+ 0x1df250001df2b,
0x1e0000001e007,
0x1e0080001e019,
0x1e01b0001e022,
0x1e0230001e025,
0x1e0260001e02b,
+ 0x1e0300001e06e,
+ 0x1e08f0001e090,
0x1e1000001e12d,
0x1e1300001e13e,
0x1e1400001e14a,
0x1e14e0001e14f,
0x1e2900001e2af,
0x1e2c00001e2fa,
+ 0x1e4d00001e4fa,
0x1e7e00001e7e7,
0x1e7e80001e7ec,
0x1e7ed0001e7ef,
@@ -2115,13 +2129,13 @@ codepoint_classes = {
0x1e8d00001e8d7,
0x1e9220001e94c,
0x1e9500001e95a,
- 0x1fbf00001fbfa,
0x200000002a6e0,
- 0x2a7000002b739,
+ 0x2a7000002b73a,
0x2b7400002b81e,
0x2b8200002cea2,
0x2ceb00002ebe1,
0x300000003134b,
+ 0x31350000323b0,
),
'CONTEXTJ': (
0x200c0000200e,
diff --git a/src/pip/_vendor/idna/uts46data.py b/src/pip/_vendor/idna/uts46data.py
index 8f65705..186796c 100644
--- a/src/pip/_vendor/idna/uts46data.py
+++ b/src/pip/_vendor/idna/uts46data.py
@@ -7,7 +7,7 @@ from typing import List, Tuple, Union
"""IDNA Mapping Table from UTS46."""
-__version__ = '14.0.0'
+__version__ = '15.0.0'
def _seg_0() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
return [
(0x0, '3'),
@@ -1300,7 +1300,7 @@ def _seg_12() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0xCE6, 'V'),
(0xCF0, 'X'),
(0xCF1, 'V'),
- (0xCF3, 'X'),
+ (0xCF4, 'X'),
(0xD00, 'V'),
(0xD0D, 'X'),
(0xD0E, 'V'),
@@ -1368,7 +1368,7 @@ def _seg_13() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0xEC6, 'V'),
(0xEC7, 'X'),
(0xEC8, 'V'),
- (0xECE, 'X'),
+ (0xECF, 'X'),
(0xED0, 'V'),
(0xEDA, 'X'),
(0xEDC, 'M', 'ຫນ'),
@@ -5917,7 +5917,7 @@ def _seg_56() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x10EAE, 'X'),
(0x10EB0, 'V'),
(0x10EB2, 'X'),
- (0x10F00, 'V'),
+ (0x10EFD, 'V'),
(0x10F28, 'X'),
(0x10F30, 'V'),
(0x10F5A, 'X'),
@@ -5956,7 +5956,7 @@ def _seg_57() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x11200, 'V'),
(0x11212, 'X'),
(0x11213, 'V'),
- (0x1123F, 'X'),
+ (0x11242, 'X'),
(0x11280, 'V'),
(0x11287, 'X'),
(0x11288, 'V'),
@@ -6097,6 +6097,8 @@ def _seg_58() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x11AA3, 'X'),
(0x11AB0, 'V'),
(0x11AF9, 'X'),
+ (0x11B00, 'V'),
+ (0x11B0A, 'X'),
(0x11C00, 'V'),
(0x11C09, 'X'),
(0x11C0A, 'V'),
@@ -6139,13 +6141,19 @@ def _seg_58() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x11DAA, 'X'),
(0x11EE0, 'V'),
(0x11EF9, 'X'),
- (0x11FB0, 'V'),
- (0x11FB1, 'X'),
- (0x11FC0, 'V'),
+ (0x11F00, 'V'),
]
def _seg_59() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
return [
+ (0x11F11, 'X'),
+ (0x11F12, 'V'),
+ (0x11F3B, 'X'),
+ (0x11F3E, 'V'),
+ (0x11F5A, 'X'),
+ (0x11FB0, 'V'),
+ (0x11FB1, 'X'),
+ (0x11FC0, 'V'),
(0x11FF2, 'X'),
(0x11FFF, 'V'),
(0x1239A, 'X'),
@@ -6158,7 +6166,9 @@ def _seg_59() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x12F90, 'V'),
(0x12FF3, 'X'),
(0x13000, 'V'),
- (0x1342F, 'X'),
+ (0x13430, 'X'),
+ (0x13440, 'V'),
+ (0x13456, 'X'),
(0x14400, 'V'),
(0x14647, 'X'),
(0x16800, 'V'),
@@ -6236,6 +6246,10 @@ def _seg_59() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x18D00, 'V'),
(0x18D09, 'X'),
(0x1AFF0, 'V'),
+ ]
+
+def _seg_60() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1AFF4, 'X'),
(0x1AFF5, 'V'),
(0x1AFFC, 'X'),
@@ -6243,13 +6257,13 @@ def _seg_59() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1AFFF, 'X'),
(0x1B000, 'V'),
(0x1B123, 'X'),
+ (0x1B132, 'V'),
+ (0x1B133, 'X'),
(0x1B150, 'V'),
(0x1B153, 'X'),
+ (0x1B155, 'V'),
+ (0x1B156, 'X'),
(0x1B164, 'V'),
- ]
-
-def _seg_60() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1B168, 'X'),
(0x1B170, 'V'),
(0x1B2FC, 'X'),
@@ -6295,6 +6309,8 @@ def _seg_60() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D1EB, 'X'),
(0x1D200, 'V'),
(0x1D246, 'X'),
+ (0x1D2C0, 'V'),
+ (0x1D2D4, 'X'),
(0x1D2E0, 'V'),
(0x1D2F4, 'X'),
(0x1D300, 'V'),
@@ -6334,6 +6350,10 @@ def _seg_60() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D41E, 'M', 'e'),
(0x1D41F, 'M', 'f'),
(0x1D420, 'M', 'g'),
+ ]
+
+def _seg_61() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D421, 'M', 'h'),
(0x1D422, 'M', 'i'),
(0x1D423, 'M', 'j'),
@@ -6350,10 +6370,6 @@ def _seg_60() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D42E, 'M', 'u'),
(0x1D42F, 'M', 'v'),
(0x1D430, 'M', 'w'),
- ]
-
-def _seg_61() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D431, 'M', 'x'),
(0x1D432, 'M', 'y'),
(0x1D433, 'M', 'z'),
@@ -6438,6 +6454,10 @@ def _seg_61() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D482, 'M', 'a'),
(0x1D483, 'M', 'b'),
(0x1D484, 'M', 'c'),
+ ]
+
+def _seg_62() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D485, 'M', 'd'),
(0x1D486, 'M', 'e'),
(0x1D487, 'M', 'f'),
@@ -6454,10 +6474,6 @@ def _seg_61() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D492, 'M', 'q'),
(0x1D493, 'M', 'r'),
(0x1D494, 'M', 's'),
- ]
-
-def _seg_62() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D495, 'M', 't'),
(0x1D496, 'M', 'u'),
(0x1D497, 'M', 'v'),
@@ -6542,6 +6558,10 @@ def _seg_62() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D4E9, 'M', 'z'),
(0x1D4EA, 'M', 'a'),
(0x1D4EB, 'M', 'b'),
+ ]
+
+def _seg_63() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D4EC, 'M', 'c'),
(0x1D4ED, 'M', 'd'),
(0x1D4EE, 'M', 'e'),
@@ -6558,10 +6578,6 @@ def _seg_62() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D4F9, 'M', 'p'),
(0x1D4FA, 'M', 'q'),
(0x1D4FB, 'M', 'r'),
- ]
-
-def _seg_63() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D4FC, 'M', 's'),
(0x1D4FD, 'M', 't'),
(0x1D4FE, 'M', 'u'),
@@ -6646,6 +6662,10 @@ def _seg_63() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D550, 'M', 'y'),
(0x1D551, 'X'),
(0x1D552, 'M', 'a'),
+ ]
+
+def _seg_64() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D553, 'M', 'b'),
(0x1D554, 'M', 'c'),
(0x1D555, 'M', 'd'),
@@ -6662,10 +6682,6 @@ def _seg_63() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D560, 'M', 'o'),
(0x1D561, 'M', 'p'),
(0x1D562, 'M', 'q'),
- ]
-
-def _seg_64() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D563, 'M', 'r'),
(0x1D564, 'M', 's'),
(0x1D565, 'M', 't'),
@@ -6750,6 +6766,10 @@ def _seg_64() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D5B4, 'M', 'u'),
(0x1D5B5, 'M', 'v'),
(0x1D5B6, 'M', 'w'),
+ ]
+
+def _seg_65() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D5B7, 'M', 'x'),
(0x1D5B8, 'M', 'y'),
(0x1D5B9, 'M', 'z'),
@@ -6766,10 +6786,6 @@ def _seg_64() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D5C4, 'M', 'k'),
(0x1D5C5, 'M', 'l'),
(0x1D5C6, 'M', 'm'),
- ]
-
-def _seg_65() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D5C7, 'M', 'n'),
(0x1D5C8, 'M', 'o'),
(0x1D5C9, 'M', 'p'),
@@ -6854,6 +6870,10 @@ def _seg_65() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D618, 'M', 'q'),
(0x1D619, 'M', 'r'),
(0x1D61A, 'M', 's'),
+ ]
+
+def _seg_66() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D61B, 'M', 't'),
(0x1D61C, 'M', 'u'),
(0x1D61D, 'M', 'v'),
@@ -6870,10 +6890,6 @@ def _seg_65() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D628, 'M', 'g'),
(0x1D629, 'M', 'h'),
(0x1D62A, 'M', 'i'),
- ]
-
-def _seg_66() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D62B, 'M', 'j'),
(0x1D62C, 'M', 'k'),
(0x1D62D, 'M', 'l'),
@@ -6958,6 +6974,10 @@ def _seg_66() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D67C, 'M', 'm'),
(0x1D67D, 'M', 'n'),
(0x1D67E, 'M', 'o'),
+ ]
+
+def _seg_67() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D67F, 'M', 'p'),
(0x1D680, 'M', 'q'),
(0x1D681, 'M', 'r'),
@@ -6974,10 +6994,6 @@ def _seg_66() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D68C, 'M', 'c'),
(0x1D68D, 'M', 'd'),
(0x1D68E, 'M', 'e'),
- ]
-
-def _seg_67() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D68F, 'M', 'f'),
(0x1D690, 'M', 'g'),
(0x1D691, 'M', 'h'),
@@ -7062,6 +7078,10 @@ def _seg_67() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D6E2, 'M', 'α'),
(0x1D6E3, 'M', 'β'),
(0x1D6E4, 'M', 'γ'),
+ ]
+
+def _seg_68() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D6E5, 'M', 'δ'),
(0x1D6E6, 'M', 'ε'),
(0x1D6E7, 'M', 'ζ'),
@@ -7078,10 +7098,6 @@ def _seg_67() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D6F2, 'M', 'ρ'),
(0x1D6F3, 'M', 'θ'),
(0x1D6F4, 'M', 'σ'),
- ]
-
-def _seg_68() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D6F5, 'M', 'τ'),
(0x1D6F6, 'M', 'υ'),
(0x1D6F7, 'M', 'φ'),
@@ -7166,6 +7182,10 @@ def _seg_68() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D747, 'M', 'σ'),
(0x1D749, 'M', 'τ'),
(0x1D74A, 'M', 'υ'),
+ ]
+
+def _seg_69() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D74B, 'M', 'φ'),
(0x1D74C, 'M', 'χ'),
(0x1D74D, 'M', 'ψ'),
@@ -7182,10 +7202,6 @@ def _seg_68() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D758, 'M', 'γ'),
(0x1D759, 'M', 'δ'),
(0x1D75A, 'M', 'ε'),
- ]
-
-def _seg_69() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D75B, 'M', 'ζ'),
(0x1D75C, 'M', 'η'),
(0x1D75D, 'M', 'θ'),
@@ -7270,6 +7286,10 @@ def _seg_69() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D7AD, 'M', 'δ'),
(0x1D7AE, 'M', 'ε'),
(0x1D7AF, 'M', 'ζ'),
+ ]
+
+def _seg_70() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1D7B0, 'M', 'η'),
(0x1D7B1, 'M', 'θ'),
(0x1D7B2, 'M', 'ι'),
@@ -7286,10 +7306,6 @@ def _seg_69() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1D7BE, 'M', 'υ'),
(0x1D7BF, 'M', 'φ'),
(0x1D7C0, 'M', 'χ'),
- ]
-
-def _seg_70() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1D7C1, 'M', 'ψ'),
(0x1D7C2, 'M', 'ω'),
(0x1D7C3, 'M', '∂'),
@@ -7359,6 +7375,8 @@ def _seg_70() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1DAB0, 'X'),
(0x1DF00, 'V'),
(0x1DF1F, 'X'),
+ (0x1DF25, 'V'),
+ (0x1DF2B, 'X'),
(0x1E000, 'V'),
(0x1E007, 'X'),
(0x1E008, 'V'),
@@ -7369,6 +7387,75 @@ def _seg_70() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1E025, 'X'),
(0x1E026, 'V'),
(0x1E02B, 'X'),
+ (0x1E030, 'M', 'а'),
+ (0x1E031, 'M', 'б'),
+ (0x1E032, 'M', 'в'),
+ ]
+
+def _seg_71() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
+ (0x1E033, 'M', 'г'),
+ (0x1E034, 'M', 'д'),
+ (0x1E035, 'M', 'е'),
+ (0x1E036, 'M', 'ж'),
+ (0x1E037, 'M', 'з'),
+ (0x1E038, 'M', 'и'),
+ (0x1E039, 'M', 'к'),
+ (0x1E03A, 'M', 'л'),
+ (0x1E03B, 'M', 'м'),
+ (0x1E03C, 'M', 'о'),
+ (0x1E03D, 'M', 'п'),
+ (0x1E03E, 'M', 'р'),
+ (0x1E03F, 'M', 'с'),
+ (0x1E040, 'M', 'т'),
+ (0x1E041, 'M', 'у'),
+ (0x1E042, 'M', 'ф'),
+ (0x1E043, 'M', 'х'),
+ (0x1E044, 'M', 'ц'),
+ (0x1E045, 'M', 'ч'),
+ (0x1E046, 'M', 'ш'),
+ (0x1E047, 'M', 'ы'),
+ (0x1E048, 'M', 'э'),
+ (0x1E049, 'M', 'ю'),
+ (0x1E04A, 'M', 'ꚉ'),
+ (0x1E04B, 'M', 'ә'),
+ (0x1E04C, 'M', 'і'),
+ (0x1E04D, 'M', 'ј'),
+ (0x1E04E, 'M', 'ө'),
+ (0x1E04F, 'M', 'ү'),
+ (0x1E050, 'M', 'ӏ'),
+ (0x1E051, 'M', 'а'),
+ (0x1E052, 'M', 'б'),
+ (0x1E053, 'M', 'в'),
+ (0x1E054, 'M', 'г'),
+ (0x1E055, 'M', 'д'),
+ (0x1E056, 'M', 'е'),
+ (0x1E057, 'M', 'ж'),
+ (0x1E058, 'M', 'з'),
+ (0x1E059, 'M', 'и'),
+ (0x1E05A, 'M', 'к'),
+ (0x1E05B, 'M', 'л'),
+ (0x1E05C, 'M', 'о'),
+ (0x1E05D, 'M', 'п'),
+ (0x1E05E, 'M', 'с'),
+ (0x1E05F, 'M', 'у'),
+ (0x1E060, 'M', 'ф'),
+ (0x1E061, 'M', 'х'),
+ (0x1E062, 'M', 'ц'),
+ (0x1E063, 'M', 'ч'),
+ (0x1E064, 'M', 'ш'),
+ (0x1E065, 'M', 'ъ'),
+ (0x1E066, 'M', 'ы'),
+ (0x1E067, 'M', 'ґ'),
+ (0x1E068, 'M', 'і'),
+ (0x1E069, 'M', 'ѕ'),
+ (0x1E06A, 'M', 'џ'),
+ (0x1E06B, 'M', 'ҫ'),
+ (0x1E06C, 'M', 'ꙑ'),
+ (0x1E06D, 'M', 'ұ'),
+ (0x1E06E, 'X'),
+ (0x1E08F, 'V'),
+ (0x1E090, 'X'),
(0x1E100, 'V'),
(0x1E12D, 'X'),
(0x1E130, 'V'),
@@ -7383,6 +7470,8 @@ def _seg_70() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1E2FA, 'X'),
(0x1E2FF, 'V'),
(0x1E300, 'X'),
+ (0x1E4D0, 'V'),
+ (0x1E4FA, 'X'),
(0x1E7E0, 'V'),
(0x1E7E7, 'X'),
(0x1E7E8, 'V'),
@@ -7390,10 +7479,6 @@ def _seg_70() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1E7ED, 'V'),
(0x1E7EF, 'X'),
(0x1E7F0, 'V'),
- ]
-
-def _seg_71() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1E7FF, 'X'),
(0x1E800, 'V'),
(0x1E8C5, 'X'),
@@ -7409,6 +7494,10 @@ def _seg_71() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1E907, 'M', '𞤩'),
(0x1E908, 'M', '𞤪'),
(0x1E909, 'M', '𞤫'),
+ ]
+
+def _seg_72() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1E90A, 'M', '𞤬'),
(0x1E90B, 'M', '𞤭'),
(0x1E90C, 'M', '𞤮'),
@@ -7494,10 +7583,6 @@ def _seg_71() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1EE31, 'M', 'ص'),
(0x1EE32, 'M', 'ق'),
(0x1EE33, 'X'),
- ]
-
-def _seg_72() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1EE34, 'M', 'ش'),
(0x1EE35, 'M', 'ت'),
(0x1EE36, 'M', 'ث'),
@@ -7513,6 +7598,10 @@ def _seg_72() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1EE48, 'X'),
(0x1EE49, 'M', 'ي'),
(0x1EE4A, 'X'),
+ ]
+
+def _seg_73() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1EE4B, 'M', 'ل'),
(0x1EE4C, 'X'),
(0x1EE4D, 'M', 'ن'),
@@ -7598,10 +7687,6 @@ def _seg_72() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1EEA3, 'M', 'د'),
(0x1EEA4, 'X'),
(0x1EEA5, 'M', 'و'),
- ]
-
-def _seg_73() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1EEA6, 'M', 'ز'),
(0x1EEA7, 'M', 'ح'),
(0x1EEA8, 'M', 'ط'),
@@ -7617,6 +7702,10 @@ def _seg_73() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1EEB2, 'M', 'ق'),
(0x1EEB3, 'M', 'ر'),
(0x1EEB4, 'M', 'ش'),
+ ]
+
+def _seg_74() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1EEB5, 'M', 'ت'),
(0x1EEB6, 'M', 'ث'),
(0x1EEB7, 'M', 'خ'),
@@ -7702,10 +7791,6 @@ def _seg_73() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1F141, 'M', 'r'),
(0x1F142, 'M', 's'),
(0x1F143, 'M', 't'),
- ]
-
-def _seg_74() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1F144, 'M', 'u'),
(0x1F145, 'M', 'v'),
(0x1F146, 'M', 'w'),
@@ -7721,6 +7806,10 @@ def _seg_74() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1F150, 'V'),
(0x1F16A, 'M', 'mc'),
(0x1F16B, 'M', 'md'),
+ ]
+
+def _seg_75() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1F16C, 'M', 'mr'),
(0x1F16D, 'V'),
(0x1F190, 'M', 'dj'),
@@ -7793,23 +7882,19 @@ def _seg_74() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1F266, 'X'),
(0x1F300, 'V'),
(0x1F6D8, 'X'),
- (0x1F6DD, 'V'),
+ (0x1F6DC, 'V'),
(0x1F6ED, 'X'),
(0x1F6F0, 'V'),
(0x1F6FD, 'X'),
(0x1F700, 'V'),
- (0x1F774, 'X'),
- (0x1F780, 'V'),
- (0x1F7D9, 'X'),
+ (0x1F777, 'X'),
+ (0x1F77B, 'V'),
+ (0x1F7DA, 'X'),
(0x1F7E0, 'V'),
(0x1F7EC, 'X'),
(0x1F7F0, 'V'),
(0x1F7F1, 'X'),
(0x1F800, 'V'),
- ]
-
-def _seg_75() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x1F80C, 'X'),
(0x1F810, 'V'),
(0x1F848, 'X'),
@@ -7825,24 +7910,24 @@ def _seg_75() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x1FA54, 'X'),
(0x1FA60, 'V'),
(0x1FA6E, 'X'),
+ ]
+
+def _seg_76() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x1FA70, 'V'),
- (0x1FA75, 'X'),
- (0x1FA78, 'V'),
(0x1FA7D, 'X'),
(0x1FA80, 'V'),
- (0x1FA87, 'X'),
+ (0x1FA89, 'X'),
(0x1FA90, 'V'),
- (0x1FAAD, 'X'),
- (0x1FAB0, 'V'),
- (0x1FABB, 'X'),
- (0x1FAC0, 'V'),
+ (0x1FABE, 'X'),
+ (0x1FABF, 'V'),
(0x1FAC6, 'X'),
- (0x1FAD0, 'V'),
- (0x1FADA, 'X'),
+ (0x1FACE, 'V'),
+ (0x1FADC, 'X'),
(0x1FAE0, 'V'),
- (0x1FAE8, 'X'),
+ (0x1FAE9, 'X'),
(0x1FAF0, 'V'),
- (0x1FAF7, 'X'),
+ (0x1FAF9, 'X'),
(0x1FB00, 'V'),
(0x1FB93, 'X'),
(0x1FB94, 'V'),
@@ -7861,7 +7946,7 @@ def _seg_75() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x20000, 'V'),
(0x2A6E0, 'X'),
(0x2A700, 'V'),
- (0x2B739, 'X'),
+ (0x2B73A, 'X'),
(0x2B740, 'V'),
(0x2B81E, 'X'),
(0x2B820, 'V'),
@@ -7910,10 +7995,6 @@ def _seg_75() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F827, 'M', '勤'),
(0x2F828, 'M', '勺'),
(0x2F829, 'M', '包'),
- ]
-
-def _seg_76() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x2F82A, 'M', '匆'),
(0x2F82B, 'M', '北'),
(0x2F82C, 'M', '卉'),
@@ -7933,6 +8014,10 @@ def _seg_76() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F83C, 'M', '咞'),
(0x2F83D, 'M', '吸'),
(0x2F83E, 'M', '呈'),
+ ]
+
+def _seg_77() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x2F83F, 'M', '周'),
(0x2F840, 'M', '咢'),
(0x2F841, 'M', '哶'),
@@ -8014,10 +8099,6 @@ def _seg_76() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F88F, 'M', '𪎒'),
(0x2F890, 'M', '廾'),
(0x2F891, 'M', '𢌱'),
- ]
-
-def _seg_77() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x2F893, 'M', '舁'),
(0x2F894, 'M', '弢'),
(0x2F896, 'M', '㣇'),
@@ -8037,6 +8118,10 @@ def _seg_77() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F8A4, 'M', '𢛔'),
(0x2F8A5, 'M', '惇'),
(0x2F8A6, 'M', '慈'),
+ ]
+
+def _seg_78() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x2F8A7, 'M', '慌'),
(0x2F8A8, 'M', '慎'),
(0x2F8A9, 'M', '慌'),
@@ -8118,10 +8203,6 @@ def _seg_77() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F8F5, 'M', '殺'),
(0x2F8F6, 'M', '殻'),
(0x2F8F7, 'M', '𣪍'),
- ]
-
-def _seg_78() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x2F8F8, 'M', '𡴋'),
(0x2F8F9, 'M', '𣫺'),
(0x2F8FA, 'M', '汎'),
@@ -8141,6 +8222,10 @@ def _seg_78() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F908, 'M', '港'),
(0x2F909, 'M', '湮'),
(0x2F90A, 'M', '㴳'),
+ ]
+
+def _seg_79() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x2F90B, 'M', '滋'),
(0x2F90C, 'M', '滇'),
(0x2F90D, 'M', '𣻑'),
@@ -8222,10 +8307,6 @@ def _seg_78() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F95B, 'M', '穏'),
(0x2F95C, 'M', '𥥼'),
(0x2F95D, 'M', '𥪧'),
- ]
-
-def _seg_79() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x2F95F, 'X'),
(0x2F960, 'M', '䈂'),
(0x2F961, 'M', '𥮫'),
@@ -8245,6 +8326,10 @@ def _seg_79() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F96F, 'M', '縂'),
(0x2F970, 'M', '繅'),
(0x2F971, 'M', '䌴'),
+ ]
+
+def _seg_80() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x2F972, 'M', '𦈨'),
(0x2F973, 'M', '𦉇'),
(0x2F974, 'M', '䍙'),
@@ -8326,10 +8411,6 @@ def _seg_79() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F9C0, 'M', '蟡'),
(0x2F9C1, 'M', '蠁'),
(0x2F9C2, 'M', '䗹'),
- ]
-
-def _seg_80() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
- return [
(0x2F9C3, 'M', '衠'),
(0x2F9C4, 'M', '衣'),
(0x2F9C5, 'M', '𧙧'),
@@ -8349,6 +8430,10 @@ def _seg_80() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2F9D3, 'M', '𧲨'),
(0x2F9D4, 'M', '貫'),
(0x2F9D5, 'M', '賁'),
+ ]
+
+def _seg_81() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
+ return [
(0x2F9D6, 'M', '贛'),
(0x2F9D7, 'M', '起'),
(0x2F9D8, 'M', '𧼯'),
@@ -8423,6 +8508,8 @@ def _seg_80() -> List[Union[Tuple[int, str], Tuple[int, str, str]]]:
(0x2FA1E, 'X'),
(0x30000, 'V'),
(0x3134B, 'X'),
+ (0x31350, 'V'),
+ (0x323B0, 'X'),
(0xE0100, 'I'),
(0xE01F0, 'X'),
]
@@ -8509,4 +8596,5 @@ uts46data = tuple(
+ _seg_78()
+ _seg_79()
+ _seg_80()
+ + _seg_81()
) # type: Tuple[Union[Tuple[int, str], Tuple[int, str, str]], ...]

2463
backport-0005-CVE-2024-3651.patch
View File

File diff suppressed because it is too large Load Diff

28
backport-CVE-2023-43804-added-the-Cookie-to-the-list-of-headers.patch
View File

@ -1,28 +0,0 @@
From 01220354d389cd05474713f8c982d05c9b17aafb Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <sethmichaellarson@gmail.com>
Date: Mon, 2 Oct 2023 11:43:46 -0500
Subject: [PATCH] Backport GHSA-v845-jxx5-vc9f (#3139)
Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Conflict:NA
Reference:https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
---
src/pip/_vendor/urllib3/util/retry.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/pip/_vendor/urllib3/util/retry.py b/src/pip/_vendor/urllib3/util/retry.py
index c7dc42f..c7c0427 100644
--- a/src/pip/_vendor/urllib3/util/retry.py
+++ b/src/pip/_vendor/urllib3/util/retry.py
@@ -217,7 +217,7 @@ class Retry(object):
RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
#: Default headers to be used for ``remove_headers_on_redirect``
- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Authorization"])
+ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
#: Maximum backoff time.
BACKOFF_MAX = 120

94
backport-CVE-2023-45803-Made-body-stripped-from-HTTP-requests.patch
View File

@ -1,94 +0,0 @@
From b594c5ceaca38e1ac215f916538fb128e3526a36 Mon Sep 17 00:00:00 2001
From: Illia Volochii <illia.volochii@gmail.com>
Date: Tue, 17 Oct 2023 19:35:39 +0300
Subject: [PATCH] Merge pull request from GHSA-g4mx-q9vg-27p4
---
src/pip/_vendor/urllib3/_collections.py | 18 ++++++++++++++++++
src/pip/_vendor/urllib3/connectionpool.py | 5 +++++
src/pip/_vendor/urllib3/poolmanager.py | 7 +++++--
3 files changed, 28 insertions(+), 2 deletions(-)
diff --git a/src/pip/_vendor/urllib3/_collections.py b/src/pip/_vendor/urllib3/_collections.py
index da9857e9..bceb8451 100644
--- a/src/pip/_vendor/urllib3/_collections.py
+++ b/src/pip/_vendor/urllib3/_collections.py
@@ -268,6 +268,24 @@ class HTTPHeaderDict(MutableMapping):
else:
return vals[1:]
+ def _prepare_for_method_change(self):
+ """
+ Remove content-specific header fields before changing the request
+ method to GET or HEAD according to RFC 9110, Section 15.4.
+ """
+ content_specific_headers = [
+ "Content-Encoding",
+ "Content-Language",
+ "Content-Location",
+ "Content-Type",
+ "Content-Length",
+ "Digest",
+ "Last-Modified",
+ ]
+ for header in content_specific_headers:
+ self.discard(header)
+ return self
+
# Backwards compatibility for httplib
getheaders = getlist
getallmatchingheaders = getlist
diff --git a/src/pip/_vendor/urllib3/connectionpool.py b/src/pip/_vendor/urllib3/connectionpool.py
index 96844d93..5a6adcbd 100644
--- a/src/pip/_vendor/urllib3/connectionpool.py
+++ b/src/pip/_vendor/urllib3/connectionpool.py
@@ -9,6 +9,7 @@ import warnings
from socket import error as SocketError
from socket import timeout as SocketTimeout
+from ._collections import HTTPHeaderDict
from .connection import (
BaseSSLError,
BrokenPipeError,
@@ -843,7 +844,11 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods):
redirect_location = redirect and response.get_redirect_location()
if redirect_location:
if response.status == 303:
+ # Change the method according to RFC 9110, Section 15.4.4.
method = "GET"
+ # And lose the body not to transfer anything sensitive.
+ body = None
+ headers = HTTPHeaderDict(headers)._prepare_for_method_change()
try:
retries = retries.increment(method, url, response=response, _pool=self)
diff --git a/src/pip/_vendor/urllib3/poolmanager.py b/src/pip/_vendor/urllib3/poolmanager.py
index 14b10daf..fb51bf7d 100644
--- a/src/pip/_vendor/urllib3/poolmanager.py
+++ b/src/pip/_vendor/urllib3/poolmanager.py
@@ -4,7 +4,7 @@ import collections
import functools
import logging
-from ._collections import RecentlyUsedContainer
+from ._collections import HTTPHeaderDict, RecentlyUsedContainer
from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme
from .exceptions import (
LocationValueError,
@@ -382,9 +382,12 @@ class PoolManager(RequestMethods):
# Support relative URLs for redirecting.
redirect_location = urljoin(url, redirect_location)
- # RFC 7231, Section 6.4.4
if response.status == 303:
+ # Change the method according to RFC 9110, Section 15.4.4.
method = "GET"
+ # And lose the body not to transfer anything sensitive.
+ kw["body"] = None
+ kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change()
retries = kw.get("retries")
if not isinstance(retries, Retry):
--
2.33.0

29
backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch
View File

@ -1,29 +0,0 @@
From accff72ecc2f6cf5a76d9570198a93ac7c90270e Mon Sep 17 00:00:00 2001
From: Quentin Pradet <quentin.pradet@gmail.com>
Date: Mon, 17 Jun 2024 11:09:06 +0400
Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf
* Strip Proxy-Authorization header on redirects
---
src/pip/_vendor/urllib3/util/retry.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/pip/_vendor/urllib3/util/retry.py b/src/pip/_vendor/urllib3/util/retry.py
index c7c0427..7e438b9 100644
--- a/src/pip/_vendor/urllib3/util/retry.py
+++ b/src/pip/_vendor/urllib3/util/retry.py
@@ -217,7 +217,9 @@ class Retry(object):
RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
#: Default headers to be used for ``remove_headers_on_redirect``
- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
+ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(
+ ["Cookie", "Authorization", "Proxy-Authorization"]
+ )
#: Maximum backoff time.
BACKOFF_MAX = 120
--
2.33.0

25
backport-fix-vulnerable-regex.patch
View File

@ -1,25 +0,0 @@
From 254e668eef34ca21005634a2bdba9d9a74deaa26 Mon Sep 17 00:00:00 2001
From: M00nL1ght <69127692+SCH227@users.noreply.github.com>
Date: Tue, 30 Aug 2022 05:51:29 +0300
Subject: [PATCH] Fix vulnerable regex
Implement exclusive RE searches to avoid backtracking
---
src/pip/_internal/models/wheel.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/pip/_internal/models/wheel.py b/src/pip/_internal/models/wheel.py
index 35c70375539..a5dc12bdd63 100644
--- a/src/pip/_internal/models/wheel.py
+++ b/src/pip/_internal/models/wheel.py
@@ -13,8 +13,8 @@ class Wheel:
"""A wheel file"""
wheel_file_re = re.compile(
- r"""^(?P<namever>(?P<name>.+?)-(?P<ver>.*?))
- ((-(?P<build>\d[^-]*?))?-(?P<pyver>.+?)-(?P<abi>.+?)-(?P<plat>.+?)
+ r"""^(?P<namever>(?P<name>[^\s-]+?)-(?P<ver>[^\s-]*?))
+ ((-(?P<build>\d[^-]*?))?-(?P<pyver>[^\s-]+?)-(?P<abi>[^\s-]+?)-(?P<plat>[^\s-]+?)
\.whl|\.dist-info)$""",
re.VERBOSE,
)

5
pip.huaweicloud.conf Normal file
View File

@ -0,0 +1,5 @@
[global]
index-url = https://repo.huaweicloud.com/repository/pypi/simple
[install]
trusted-host = https://repo.huaweicloud.com

33
python-pip.spec
View File

@ -6,26 +6,18 @@ pip is the package installer for Python. You can use pip to install packages fro
%global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-%{_sysconfdir}/bash_completion.d})
Name: python-%{srcname}
Version: 21.3.1
Release: 8
Release: 3
Summary: A tool for installing and managing Python packages
License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)
URL: http://www.pip-installer.org
Source0: %{pypi_source}
Source1: pip.loongarch.conf
Source1: pip.huaweicloud.conf
Source2: pip.loongarch.conf
BuildArch: noarch
Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files.patch
Patch2: emit-a-warning-when-running-with-root-privileges.patch
Patch3: remove-existing-dist-only-if-path-conflicts.patch
Patch6000: dummy-certifi.patch
Patch6001: backport-fix-vulnerable-regex.patch
Patch6002: backport-0001-CVE-2024-3651.patch
Patch6003: backport-0002-CVE-2024-3651.patch
Patch6004: backport-0003-CVE-2024-3651.patch
Patch6005: backport-0004-CVE-2024-3651.patch
Patch6006: backport-0005-CVE-2024-3651.patch
Patch6007: backport-CVE-2023-43804-added-the-Cookie-to-the-list-of-headers.patch
Patch6008: backport-CVE-2023-45803-Made-body-stripped-from-HTTP-requests.patch
Patch6009: backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch
Source10: pip-allow-older-versions.patch
@ -109,14 +101,14 @@ install -p dist/%{python_wheelname} -t %{buildroot}%{python_wheeldir}
# Set default pip mirror via pip.conf
%ifarch loongarch64
install -D -m0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pip.conf
%else
install -D -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pip.conf
%endif
%files -n python%{python3_pkgversion}-%{srcname}
%license LICENSE.txt
%ifarch loongarch64
%config(noreplace) %{_sysconfdir}/pip.conf
%endif
%{_bindir}/pip
%{_bindir}/pip3
%{_bindir}/pip-3*
@ -135,21 +127,6 @@ install -D -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pip.conf
%{python_wheeldir}/%{python_wheelname}
%changelog
* Wed Jun 26 2024 zhangruifang <zhangruifang@h-partners.com> - 21.3.1-8
- fix CVE-2023-45803 CVE-2024-37891
* Mon Jun 17 2024 yangyuan <yangyuan32@huawei.com> - 21.3.1-7
- fix CVE-2023-43804
* Fri Jun 7 2024 yangyuan <yangyuan32@huawei.com> - 21.3.1-6
- fix CVE-2024-3651
* Wed Dec 13 2023 yanglongkang <yanglongkang@h-partners.com>- 21.3.1-5
- Fix vulnerable regex
* Fri Sep 08 2023 zhuofeng <zhuofeng2@huawei.com> - 21.3.1-4
- fix that pip install failed
* Mon Jul 31 2023 Funda Wang <fundawang@yeah.net> - 21.3.1-3
- Use local mirrors for pip