import CS dnf-4.7.0-20.el8

SOURCES/0045-RHEL-1245-Remove-usrbin-from-syspath-noimpor-garbage.patch

@@ -0,0 +1,85 @@
+From 29f4df4bf7bf7cb9099dbc7c834441ce4e75b623 Mon Sep 17 00:00:00 2001
+From: Miro Hrončok <miro@hroncok.cz>
+Date: Wed, 23 Feb 2022 13:25:12 +0100
+Subject: [PATCH] RHEL-1245: Remove /usr/bin from sys.path to avoid accidentally importing garbage
+
+See https://bugzilla.redhat.com/show_bug.cgi?id=2057340
+and https://github.com/benjaminp/six/issues/359
+
+dnf should never import Python modules from /usr/bin but users can
+have files in there that look like Python modules and Python will
+try to import them and fail.
+
+Consider a tool that is *not* written in Python and is called "copy.pyc".
+Naturally, it resides in /usr/bin/copy.pyc and dnf fails:
+
+    Traceback (most recent call last):
+      File "/usr/bin/dnf", line 57, in <module>
+        from dnf.cli import main
+      File "/usr/lib/python3.10/site-packages/dnf/__init__.py", line 30, in <module>
+        import dnf.base
+      File "/usr/lib/python3.10/site-packages/dnf/base.py", line 31, in <module>
+        from copy import deepcopy
+    ImportError: bad magic number in 'copy': b'...'
+
+Similarly, a tool actually written in Python, called "copy.py"
+might as well own /usr/bin/copy.py and dnf fails as well:
+
+    Traceback (most recent call last):
+      File "/usr/bin/dnf", line 57, in <module>
+        from dnf.cli import main
+      File "/usr/lib/python3.10/site-packages/dnf/__init__.py", line 30, in <module>
+        import dnf.base
+      File "/usr/lib/python3.10/site-packages/dnf/base.py", line 31, in <module>
+        from copy import deepcopy
+    ImportError: cannot import name 'deepcopy' from 'copy' (/usr/bin/copy.py)
+
+Either problem can happen for a variety of names.
+We better not let that happen.
+
+A more general solution that would prevent Python doing this entirely
+does not exists yet, see https://discuss.python.org/t/4235
+
+Hence, proposing this to dnf, which is a critical piece of the system.
+---
+ bin/dnf-automatic.in | 6 +++++-
+ bin/dnf.in           | 6 +++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/bin/dnf-automatic.in b/bin/dnf-automatic.in
+index 5b06aa2..17e35a0 100755
+--- a/bin/dnf-automatic.in
++++ b/bin/dnf-automatic.in
+@@ -23,7 +23,11 @@ import os
+ import sys
+ 
+ here = sys.path[0]
+-if here != '/usr/bin':
++if here == '/usr/bin':
++    # we never import Python modules from /usr/bin
++    # removing this lowers the risk of accidental imports of weird files
++    del sys.path[0]
++else:
+     # git checkout
+     dnf_toplevel = os.path.dirname(here)
+     sys.path[0] = dnf_toplevel
+diff --git a/bin/dnf.in b/bin/dnf.in
+index 645d0f0..55ceb3f 100755
+--- a/bin/dnf.in
++++ b/bin/dnf.in
+@@ -48,7 +48,11 @@ if __name__ != "__main__":
+     sys.exit(1)
+ 
+ here = sys.path[0]
+-if here != '/usr/bin':
++if here == '/usr/bin':
++    # we never import Python modules from /usr/bin
++    # removing this lowers the risk of accidental imports of weird files
++    del sys.path[0]
++else:
+     # git checkout
+     import os
+     dnf_toplevel = os.path.dirname(here)
+--
+libgit2 1.6.4
+

SOURCES/0047-RHEL-11786-Fix-substitution-in-kvp-in-add_new_repo.patch

@@ -0,0 +1,53 @@
+From 8bc3b7a217de41c0a9bc52cd9cac50cde9e9ee65 Mon Sep 17 00:00:00 2001
+From: Anish Bhatt <anish.bhatt@salesforce.com>
+Date: Mon, 10 Jul 2023 10:09:17 -0700
+Subject: [PATCH] When parsing over a KVP list, do not return till the whole
+ list is parsed
+
+---
+ dnf/repodict.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/dnf/repodict.py b/dnf/repodict.py
+index ffa0f8ed..82c05ac0 100644
+--- a/dnf/repodict.py
++++ b/dnf/repodict.py
+@@ -79,8 +79,8 @@ class RepoDict(dict):
+                     if isinstance(value, str):
+                         substituted.append(
+                             libdnf.conf.ConfigParser.substitute(value, conf.substitutions))
+-                    if substituted:
+-                        return substituted
++                if substituted:
++                    return substituted
+             return values
+ 
+         repo = dnf.repo.Repo(repoid, conf)
+-- 
+2.41.0
+
+
+From 89c6f3633f55acd31d44a487ce76dd89c12d795c Mon Sep 17 00:00:00 2001
+From: Anish Bhatt <anish.bhatt@salesforce.com>
+Date: Mon, 10 Jul 2023 10:10:30 -0700
+Subject: [PATCH] Add to authors
+
+---
+ AUTHORS | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/AUTHORS b/AUTHORS
+index 0077c7ea..eb1e0121 100644
+--- a/AUTHORS
++++ b/AUTHORS
+@@ -63,6 +63,7 @@ DNF CONTRIBUTORS
+     Adam Williamson <awilliam@redhat.com>
+     Albert Uchytil <auchytil@redhat.com>
+     Alberto Ruiz <aruiz@redhat.com>
++    Anish Bhatt <anish.bhatt@salesforce.com>
+     Baurzhan Muftakhidinov <baurthefirst@gmail.com>
+     Christopher Meng <cickumqt@gmail.com>
+     Daniel Mach <dmach@redhat.com>
+-- 
+2.41.0
+

SPECS/dnf.spec

@@ -66,7 +66,7 @@ It supports RPMs, modules and comps groups & environments.
 
 Name:           dnf
 Version:        4.7.0
-Release:        19%{?dist}
+Release:        20%{?dist}
 Summary:        %{pkg_summary}
 # For a breakdown of the licensing, see PACKAGE-LICENSING
 License:        GPLv2+
@@ -120,6 +120,9 @@ Patch0041:      0041-Omit-src-RPMs-from-check-update-RhBug-2151910.patch
 Patch0042:      0042-Backport-automatic-Fix-onl-detect-proxy-RhBz2022440.patch
 Patch0043:      0043-automatic-Return-an-error-when-transaction-fails-RhB.patch
 Patch0044:      0044-Document-symbols-in-dnf-history-list-output.patch
+Patch0045:      0045-RHEL-1245-Remove-usrbin-from-syspath-noimpor-garbage.patch
+Patch0046:      0046-RHEL-6393-Fix-japanese-translations.patch
+Patch0047:      0047-RHEL-11786-Fix-substitution-in-kvp-in-add_new_repo.patch
 
 
 BuildArch:      noarch
@@ -420,6 +423,11 @@ popd
 %{python3_sitelib}/%{name}/automatic/
 
 %changelog
+* Mon Oct 16 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.7.0-20
+- Remove /usr/bin from sys.path to avoid accidentally importing garbage (RHEL-1245)
+- Fix japanese translations (RHEL-6393)
+- Fix substitution in kay-value-pair list in add_new_repo (RHEL-11786)
+
 * Wed Jun 28 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.7.0-19
 - Document symbols in `dnf history list` output (RhBug:2172067)