.gitignore

@@ -1 +1,63 @@
-SOURCES/SQLAlchemy-1.2.7.tar.gz
+SQLAlchemy-0.6.1.tar.gz
+/SQLAlchemy-0.6.3.tar.gz
+/SQLAlchemy-0.6.4.tar.gz
+/SQLAlchemy-0.6.5.tar.gz
+/SQLAlchemy-0.6.6.tar.gz
+/SQLAlchemy-0.7.1.tar.gz
+/SQLAlchemy-0.7.2.tar.gz
+/SQLAlchemy-0.7.3.tar.gz
+/SQLAlchemy-0.7.5.tar.gz
+/SQLAlchemy-0.7.6.tar.gz
+/SQLAlchemy-0.7.7.tar.gz
+/SQLAlchemy-0.7.8.tar.gz
+/SQLAlchemy-0.7.9dev.tar.gz
+/SQLAlchemy-0.8.0b1.tar.gz
+/SQLAlchemy-0.8.0.tar.gz
+/SQLAlchemy-0.8.1.tar.gz
+/SQLAlchemy-0.8.2.tar.gz
+/SQLAlchemy-0.8.3.tar.gz
+/SQLAlchemy-0.8.4.tar.gz
+/SQLAlchemy-0.9.1.tar.gz
+/SQLAlchemy-0.9.2.tar.gz
+/SQLAlchemy-0.9.3.tar.gz
+/SQLAlchemy-0.9.4.tar.gz
+/SQLAlchemy-0.9.6.tar.gz
+/SQLAlchemy-0.9.7.tar.gz
+/SQLAlchemy-0.9.8.tar.gz
+/SQLAlchemy-0.9.9.tar.gz
+/SQLAlchemy-1.0.0.tar.gz
+/SQLAlchemy-1.0.1.tar.gz
+/SQLAlchemy-1.0.2.tar.gz
+/SQLAlchemy-1.0.3.tar.gz
+/SQLAlchemy-1.0.4.tar.gz
+/SQLAlchemy-1.0.5.tar.gz
+/SQLAlchemy-1.0.6.tar.gz
+/SQLAlchemy-1.0.7.tar.gz
+/SQLAlchemy-1.0.8.tar.gz
+/SQLAlchemy-1.0.9.tar.gz
+/SQLAlchemy-1.0.10.tar.gz
+/SQLAlchemy-1.0.11.tar.gz
+/SQLAlchemy-1.0.12.tar.gz
+/SQLAlchemy-1.0.13.tar.gz
+/SQLAlchemy-1.0.14.tar.gz
+/SQLAlchemy-1.1.0.tar.gz
+/SQLAlchemy-1.1.1.tar.gz
+/SQLAlchemy-1.1.2.tar.gz
+/SQLAlchemy-1.1.3.tar.gz
+/SQLAlchemy-1.1.4.tar.gz
+/SQLAlchemy-1.1.5.tar.gz
+/SQLAlchemy-1.1.6.tar.gz
+/SQLAlchemy-1.1.9.tar.gz
+/SQLAlchemy-1.1.10.tar.gz
+/SQLAlchemy-1.1.11.tar.gz
+/SQLAlchemy-1.1.12.tar.gz
+/SQLAlchemy-1.1.13.tar.gz
+/SQLAlchemy-1.2.0.tar.gz
+/SQLAlchemy-1.2.2.tar.gz
+/SQLAlchemy-1.2.3.tar.gz
+/SQLAlchemy-1.2.4.tar.gz
+/SQLAlchemy-1.2.5.tar.gz
+/SQLAlchemy-1.2.6.tar.gz
+/SQLAlchemy-1.2.7.tar.gz
+/SQLAlchemy-1.2.8.tar.gz
+/SQLAlchemy-1.3.2.tar.gz

.python-sqlalchemy.metadata

@@ -1 +0,0 @@
-343aa9ade5fc6b01933f5d2d8fc97c75005ac9fa SOURCES/SQLAlchemy-1.2.7.tar.gz

SOURCES/python-sqlalchemy-1.2.8-sqlite-3.24.patch

@@ -1,28 +0,0 @@
-From 3fd3ac6d554019f54efe1935f3a25cb5939fdad3 Mon Sep 17 00:00:00 2001
-From: Nils Philippsen <nils@tiptoe.de>
-Date: Mon, 18 Jun 2018 00:08:38 +0200
-Subject: [PATCH] fix TypeReflectionTest for sqlite 3.24
-
-SQLite 3.24 added support for PostgreSQL-style UPSERT. This added two
-new keywords 'DO' and 'NOTHING' which made
-test_round_trip_direct_type_affinity() fail with a syntax error.
----
- test/dialect/test_sqlite.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test/dialect/test_sqlite.py b/test/dialect/test_sqlite.py
-index 4c462aed1..d2d563208 100644
---- a/test/dialect/test_sqlite.py
-+++ b/test/dialect/test_sqlite.py
-@@ -1637,7 +1637,7 @@ class TypeReflectionTest(fixtures.TestBase):
-             ("BLOBBER", sqltypes.NullType()),
-             ("DOUBLE PRECISION", sqltypes.REAL()),
-             ("FLOATY", sqltypes.REAL()),
--            ("NOTHING WE KNOW", sqltypes.NUMERIC()),
-+            ("SOMETHING UNKNOWN", sqltypes.NUMERIC()),
-         ]
- 
-     def _fixture_as_string(self, fixture):
--- 
-2.17.1
-

fix-regression-in-ambiguous-join-logic.patch

@@ -0,0 +1,115 @@
+diff --git a/lib/sqlalchemy/sql/util.py b/lib/sqlalchemy/sql/util.py
+index 3077840..8719b26 100644
+--- a/lib/sqlalchemy/sql/util.py
++++ b/lib/sqlalchemy/sql/util.py
+@@ -20,6 +20,7 @@ from .annotation import _shallow_annotate  # noqa
+ from .base import _from_objects
+ from .base import ColumnSet
+ from .ddl import sort_tables  # noqa
++from .elements import _expand_cloned
+ from .elements import _find_columns  # noqa
+ from .elements import _label_reference
+ from .elements import _textual_label_reference
+@@ -149,6 +150,16 @@ def find_left_clause_to_join_from(clauses, join_to, onclause):
+                 idx.append(i)
+                 break
+ 
++    if len(idx) > 1:
++        # this is the same "hide froms" logic from
++        # Selectable._get_display_froms
++        toremove = set(
++            chain(*[_expand_cloned(f._hide_froms) for f in clauses])
++        )
++        idx = [
++            i for i in idx if clauses[i] not in toremove
++        ]
++
+     # onclause was given and none of them resolved, so assume
+     # all indexes can match
+     if not idx and onclause is not None:
+diff --git a/test/orm/test_joins.py b/test/orm/test_joins.py
+index bb9747c..4fe04f7 100644
+--- a/test/orm/test_joins.py
++++ b/test/orm/test_joins.py
+@@ -1559,6 +1559,81 @@ class JoinTest(QueryTest, AssertsCompiledSQL):
+             "ON dingalings.address_id = addresses_1.id",
+         )
+ 
++    def test_clause_present_in_froms_twice_w_onclause(self):
++        # test [ticket:4584]
++        Order, Address, Dingaling, User = (
++            self.classes.Order,
++            self.classes.Address,
++            self.classes.Dingaling,
++            self.classes.User,
++        )
++
++        sess = create_session()
++
++        a1 = aliased(Address)
++
++        q = sess.query(Order).select_from(Order, a1, User)
++        assert_raises_message(
++            sa.exc.InvalidRequestError,
++            "Can't determine which FROM clause to join from, there are "
++            "multiple FROMS which can join to this entity. "
++            "Try adding an explicit ON clause to help resolve the ambiguity.",
++            q.outerjoin,
++            a1,
++        )
++
++        # the condition which occurs here is: Query._from_obj contains both
++        # "a1" by itself as well as a join that "a1" is part of.
++        # find_left_clause_to_join_from() needs to include removal of froms
++        # that are in the _hide_froms of joins the same way
++        # Selectable._get_display_froms does.
++        q = sess.query(Order).select_from(Order, a1, User)
++        q = q.outerjoin(a1, a1.id == Order.address_id)
++        q = q.outerjoin(User, a1.user_id == User.id)
++
++        self.assert_compile(
++            q,
++            "SELECT orders.id AS orders_id, orders.user_id AS orders_user_id, "
++            "orders.address_id AS orders_address_id, "
++            "orders.description AS orders_description, "
++            "orders.isopen AS orders_isopen "
++            "FROM orders "
++            "LEFT OUTER JOIN addresses AS addresses_1 "
++            "ON addresses_1.id = orders.address_id "
++            "LEFT OUTER JOIN users ON addresses_1.user_id = users.id",
++        )
++
++    def test_clause_present_in_froms_twice_wo_onclause(self):
++        # test [ticket:4584]
++        Order, Address, Dingaling, User = (
++            self.classes.Order,
++            self.classes.Address,
++            self.classes.Dingaling,
++            self.classes.User,
++        )
++
++        sess = create_session()
++
++        a1 = aliased(Address)
++
++        # the condition which occurs here is: Query._from_obj contains both
++        # "a1" by itself as well as a join that "a1" is part of.
++        # find_left_clause_to_join_from() needs to include removal of froms
++        # that are in the _hide_froms of joins the same way
++        # Selectable._get_display_froms does.
++        q = sess.query(User).select_from(Dingaling, a1, User)
++        q = q.outerjoin(a1, User.id == a1.user_id)
++        q = q.outerjoin(Dingaling)
++
++        self.assert_compile(
++            q,
++            "SELECT users.id AS users_id, users.name AS users_name "
++            "FROM users LEFT OUTER JOIN addresses AS addresses_1 "
++            "ON users.id = addresses_1.user_id "
++            "LEFT OUTER JOIN dingalings "
++            "ON addresses_1.id = dingalings.address_id",
++        )
++
+     def test_multiple_adaption(self):
+         Item, Order, User = (
+             self.classes.Item,

python-sqlalchemy.spec

@@ -1,19 +1,21 @@
+%global debug_package %{nil}
+
 %if 0%{?fedora} || 0%{?rhel} > 7
-%global with_python3 1
+%bcond_without python3
 %endif
 
-%if 0%{?rhel} > 7
+# python2X and python3X are built form the same module, so we need a conditional for python2 bits
-# Disable python2 build by default
+# the state of the conditional is not important in the spec, it is set in modulemd
 %bcond_with python2
-%else
+
-%bcond_without python2
+
-%endif
+%bcond_with python36_module
 
 %global srcname SQLAlchemy
 
 Name:           python-sqlalchemy
-Version:        1.2.7
+Version:        1.3.2
-Release:        3%{?dist}
+Release:        2%{?dist}
 Summary:        Modular and flexible ORM library for python
 
 Group:          Development/Libraries
@@ -21,9 +23,11 @@ License:        MIT
 URL:            http://www.sqlalchemy.org/
 Source0:        https://files.pythonhosted.org/packages/source/S/%{srcname}/%{srcname}-%{version}.tar.gz
 
-# Fix tests for sqlite 3.24
+# Fold entities into existing joins when resolving FROM ambiguity.
-# https://github.com/zzzeek/sqlalchemy/pull/452
+# This regression was introduced with the 1.3 sqlalchemy series.
-Patch1:         python-sqlalchemy-1.2.8-sqlite-3.24.patch
+# Fixed upstream: https://github.com/sqlalchemy/sqlalchemy/commit/25a42e93f4ef5ce1a9f9c23fbcdea3e21a7b3f1a
+# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1829932
+Patch0:         fix-regression-in-ambiguous-join-logic.patch
 
 BuildRequires:  gcc
 
@@ -32,10 +36,15 @@ BuildRequires:  python2-devel >= 2.6
 BuildRequires:  python2-setuptools
 BuildRequires:  python2-mock
 BuildRequires:  python2-pytest
-%endif # with python2
+%endif
 
-%if 0%{?with_python3}
+%if %{with python3}
+%if %{with python36_module}
+BuildRequires:  python36-devel
+BuildRequires:  python36-rpm-macros
+%else
 BuildRequires:  python3-devel
+%endif
 BuildRequires:  python3-setuptools
 BuildRequires:  python3-pytest
 %endif
@@ -49,6 +58,8 @@ as you choose, determining relationships based on foreign keys or letting you
 define the join conditions explicitly, to bridge the gap between database and
 domain.
 
+This package includes the python 2 version of the module.
+
 %package doc
 Summary:        Documentation for SQLAlchemy
 BuildArch:      noarch
@@ -72,9 +83,9 @@ define the join conditions explicitly, to bridge the gap between database and
 domain.
 
 This package includes the python 2 version of the module.
-%endif # with python2
+%endif
 
-%if 0%{?with_python3}
+%if %{with python3}
 %package -n python3-sqlalchemy
 Summary:        Modular and flexible ORM library for python
 Group:          Development/Libraries
@@ -90,31 +101,23 @@ define the join conditions explicitly, to bridge the gap between database and
 domain.
 
 This package includes the python 3 version of the module.
-%endif # with_python3
+%endif # with python3
-
-# Filter unnecessary dependencies
-%global __provides_exclude_from ^(%{python2_sitearch}|%{python3_sitearch})/.*\\.so$
 
 %prep
-%setup -q -n %{srcname}-%{version}
+%setup -n %{srcname}-%{version}
-
+%patch0 -p1
-%patch1 -p1 -b .sqlite-3.24
 
 %build
-%if %{with python2}
+%{?with_python2:%py2_build}
-%py2_build
-%endif # with python2
 
-%if 0%{?with_python3}
+%if %{with python3}
 %py3_build
 %endif
 
 %install
-%if %{with python2}
+%{?with_python2:%py2_install}
-%py2_install
-%endif # with python2
 
-%if 0%{?with_python3}
+%if %{with python3}
 %py3_install
 %endif
 
@@ -122,11 +125,9 @@ This package includes the python 3 version of the module.
 rm -rf doc/build
 
 %check
-%if %{with python2}
+%{?with_python2:PYTHONPATH=. %{__python2} -m pytest test}
-PYTHONPATH=. %{__python2} -m pytest test
-%endif # with python2
 
-%if 0%{?with_python3}
+%if %{with python3}
 PYTHONPATH=. %{__python3} -m pytest test
 %endif
 
@@ -139,21 +140,46 @@ PYTHONPATH=. %{__python3} -m pytest test
 %license LICENSE
 %doc README.rst
 %{python2_sitearch}/*
-%endif # with python2
+%endif
 
-%if 0%{?with_python3}
+%if %{with python3}
 %files -n python3-sqlalchemy
 %license LICENSE
 %doc README.rst
 %{python3_sitearch}/*
-%endif # with_python3
+%endif # with python3
 
 %changelog
-* Wed Aug 01 2018 Petr Viktorin <pviktori@redhat.com> - 1.2.7-3
+* Fri May 15 2020 Charalampos Stratakis <cstratak@redhat.com> - 1.3.2-2
-- Fix tests with SQLite 3.24+
+- Fix regression in ambiguous join logic
+Resolves: rhbz#1829932
 
-* Thu Jun 14 2018 Charalampos Stratakis <cstratak@redhat.com> - 1.2.7-2
+* Fri Apr 05 2019 Charalampos Stratakis <cstratak@redhat.com> - 1.3.2-1
-- Conditionalize the python2 subpackage
+- Rebase to 1.3.2 to fix CVE-2019-7164 and CVE-2019-7548
+Resolves: rhbz#1695754
+
+* Tue Jul 31 2018 Lumír Balhar <lbalhar@redhat.com> - 1.2.8-6
+- Switch python3 coditions to bcond
+
+* Wed Jul 18 2018 Tomas Orsava <torsava@redhat.com> - 1.2.8-5
+- BuildRequire also python36-rpm-macros as part of the python36 module build
+
+* Wed Jul 04 2018 Miro Hrončok <mhroncok@redhat.com> - 1.2.8-4
+- Add a bcond for python2
+- Remove provides filter, it was only needed 100 years ago
+
+* Sun Jun 17 2018 Nils Philippsen <nils@tiptoe.de> - 1.2.8-3
+- rename patch, apply with backups
+- fix failing test for sqlite 3.24 instead of skipping it
+
+* Thu Jun 14 2018 Miro Hrončok <mhroncok@redhat.com> - 1.2.8-2
+- Rebuilt for Python 3.7
+
+* Tue Jun 05 2018 Nils Philippsen <nils@tiptoe.de> - 1.2.8-1
+- version 1.2.8
+
+* Mon Apr 30 2018 Tomas Orsava <torsava@redhat.com> - 1.2.7-2
+- Require the python36-devel package when building for the python36 module
 
 * Sun Apr 22 2018 Nils Philippsen <nils@tiptoe.de> - 1.2.7-1
 - version 1.2.7

rpminspect.yaml

@@ -0,0 +1,13 @@
+# We have disabled the debuginfo package
+# generation due to issues with modularity
+debuginfo:
+    ignore:
+        - /usr/lib*/python*/site-packages/sqlalchemy/cprocessors.so
+        - /usr/lib*/python*/site-packages/sqlalchemy/cresultproxy.so
+        - /usr/lib*/python*/site-packages/sqlalchemy/cutils.so
+
+# In a modular build rpminspect confuses the python2-libs for a
+# subpackage of sqlalchemy. Ignore this check.
+rpmdeps:
+    ignore:
+        requires: ^libpython[0-9]+\.[0-9]+\.so.*\(\)\(.*\)$

sources

@@ -0,0 +1 @@
+SHA512 (SQLAlchemy-1.3.2.tar.gz) = fbbcff21e722a26a914d701cce430fcc5dac503fffb65e385e86754f39b585b5a4c6b4914533bc4adfe48269130e9b5c1c8c539aa60481c721c2ce7cfedca1bf