import UBI dnf-4.7.0-20.el8

This commit is contained in:
eabdullin 2024-05-22 13:29:50 +00:00
parent 15037b66f4
commit 79a532a9b3
4 changed files with 1365 additions and 1 deletions

View File

@ -0,0 +1,85 @@
From 29f4df4bf7bf7cb9099dbc7c834441ce4e75b623 Mon Sep 17 00:00:00 2001
From: Miro Hrončok <miro@hroncok.cz>
Date: Wed, 23 Feb 2022 13:25:12 +0100
Subject: [PATCH] RHEL-1245: Remove /usr/bin from sys.path to avoid accidentally importing garbage
See https://bugzilla.redhat.com/show_bug.cgi?id=2057340
and https://github.com/benjaminp/six/issues/359
dnf should never import Python modules from /usr/bin but users can
have files in there that look like Python modules and Python will
try to import them and fail.
Consider a tool that is *not* written in Python and is called "copy.pyc".
Naturally, it resides in /usr/bin/copy.pyc and dnf fails:
Traceback (most recent call last):
File "/usr/bin/dnf", line 57, in <module>
from dnf.cli import main
File "/usr/lib/python3.10/site-packages/dnf/__init__.py", line 30, in <module>
import dnf.base
File "/usr/lib/python3.10/site-packages/dnf/base.py", line 31, in <module>
from copy import deepcopy
ImportError: bad magic number in 'copy': b'...'
Similarly, a tool actually written in Python, called "copy.py"
might as well own /usr/bin/copy.py and dnf fails as well:
Traceback (most recent call last):
File "/usr/bin/dnf", line 57, in <module>
from dnf.cli import main
File "/usr/lib/python3.10/site-packages/dnf/__init__.py", line 30, in <module>
import dnf.base
File "/usr/lib/python3.10/site-packages/dnf/base.py", line 31, in <module>
from copy import deepcopy
ImportError: cannot import name 'deepcopy' from 'copy' (/usr/bin/copy.py)
Either problem can happen for a variety of names.
We better not let that happen.
A more general solution that would prevent Python doing this entirely
does not exists yet, see https://discuss.python.org/t/4235
Hence, proposing this to dnf, which is a critical piece of the system.
---
bin/dnf-automatic.in | 6 +++++-
bin/dnf.in | 6 +++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/bin/dnf-automatic.in b/bin/dnf-automatic.in
index 5b06aa2..17e35a0 100755
--- a/bin/dnf-automatic.in
+++ b/bin/dnf-automatic.in
@@ -23,7 +23,11 @@ import os
import sys
here = sys.path[0]
-if here != '/usr/bin':
+if here == '/usr/bin':
+ # we never import Python modules from /usr/bin
+ # removing this lowers the risk of accidental imports of weird files
+ del sys.path[0]
+else:
# git checkout
dnf_toplevel = os.path.dirname(here)
sys.path[0] = dnf_toplevel
diff --git a/bin/dnf.in b/bin/dnf.in
index 645d0f0..55ceb3f 100755
--- a/bin/dnf.in
+++ b/bin/dnf.in
@@ -48,7 +48,11 @@ if __name__ != "__main__":
sys.exit(1)
here = sys.path[0]
-if here != '/usr/bin':
+if here == '/usr/bin':
+ # we never import Python modules from /usr/bin
+ # removing this lowers the risk of accidental imports of weird files
+ del sys.path[0]
+else:
# git checkout
import os
dnf_toplevel = os.path.dirname(here)
--
libgit2 1.6.4

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,53 @@
From 8bc3b7a217de41c0a9bc52cd9cac50cde9e9ee65 Mon Sep 17 00:00:00 2001
From: Anish Bhatt <anish.bhatt@salesforce.com>
Date: Mon, 10 Jul 2023 10:09:17 -0700
Subject: [PATCH] When parsing over a KVP list, do not return till the whole
list is parsed
---
dnf/repodict.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/dnf/repodict.py b/dnf/repodict.py
index ffa0f8ed..82c05ac0 100644
--- a/dnf/repodict.py
+++ b/dnf/repodict.py
@@ -79,8 +79,8 @@ class RepoDict(dict):
if isinstance(value, str):
substituted.append(
libdnf.conf.ConfigParser.substitute(value, conf.substitutions))
- if substituted:
- return substituted
+ if substituted:
+ return substituted
return values
repo = dnf.repo.Repo(repoid, conf)
--
2.41.0
From 89c6f3633f55acd31d44a487ce76dd89c12d795c Mon Sep 17 00:00:00 2001
From: Anish Bhatt <anish.bhatt@salesforce.com>
Date: Mon, 10 Jul 2023 10:10:30 -0700
Subject: [PATCH] Add to authors
---
AUTHORS | 1 +
1 file changed, 1 insertion(+)
diff --git a/AUTHORS b/AUTHORS
index 0077c7ea..eb1e0121 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -63,6 +63,7 @@ DNF CONTRIBUTORS
Adam Williamson <awilliam@redhat.com>
Albert Uchytil <auchytil@redhat.com>
Alberto Ruiz <aruiz@redhat.com>
+ Anish Bhatt <anish.bhatt@salesforce.com>
Baurzhan Muftakhidinov <baurthefirst@gmail.com>
Christopher Meng <cickumqt@gmail.com>
Daniel Mach <dmach@redhat.com>
--
2.41.0

View File

@ -66,7 +66,7 @@ It supports RPMs, modules and comps groups & environments.
Name: dnf
Version: 4.7.0
Release: 19%{?dist}
Release: 20%{?dist}
Summary: %{pkg_summary}
# For a breakdown of the licensing, see PACKAGE-LICENSING
License: GPLv2+
@ -120,6 +120,9 @@ Patch0041: 0041-Omit-src-RPMs-from-check-update-RhBug-2151910.patch
Patch0042: 0042-Backport-automatic-Fix-onl-detect-proxy-RhBz2022440.patch
Patch0043: 0043-automatic-Return-an-error-when-transaction-fails-RhB.patch
Patch0044: 0044-Document-symbols-in-dnf-history-list-output.patch
Patch0045: 0045-RHEL-1245-Remove-usrbin-from-syspath-noimpor-garbage.patch
Patch0046: 0046-RHEL-6393-Fix-japanese-translations.patch
Patch0047: 0047-RHEL-11786-Fix-substitution-in-kvp-in-add_new_repo.patch
BuildArch: noarch
@ -420,6 +423,11 @@ popd
%{python3_sitelib}/%{name}/automatic/
%changelog
* Mon Oct 16 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.7.0-20
- Remove /usr/bin from sys.path to avoid accidentally importing garbage (RHEL-1245)
- Fix japanese translations (RHEL-6393)
- Fix substitution in kay-value-pair list in add_new_repo (RHEL-11786)
* Wed Jun 28 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.7.0-19
- Document symbols in `dnf history list` output (RhBug:2172067)