.gitignore

@@ -1,6 +1 @@
-/setuptools-*.tar.gz
+SOURCES/setuptools-68.2.2.tar.gz
-/setuptools-*.zip
-/setuptools-*/
-/pkg_resources-tests-data-*.tar.gz
-/results_python-setuptools/
-*.rpm

.python3.12-setuptools.metadata

@@ -0,0 +1 @@
+b0c9b16863c57d70adc22651906eea7eaee09803 SOURCES/setuptools-68.2.2.tar.gz

CVE-2024-6345.patch

@@ -1,116 +0,0 @@
-From 472528deea4063f20c5d9525f0faf64ae0cd0a90 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
-Date: Wed, 24 Jul 2024 14:26:09 +0200
-Subject: [PATCH] CVE-2024-6345
-
----
- setuptools/package_index.py           | 21 +++++----------------
- setuptools/tests/test_packageindex.py | 20 ++++++++++----------
- 2 files changed, 15 insertions(+), 26 deletions(-)
-
-diff --git a/setuptools/package_index.py b/setuptools/package_index.py
-index 7095585..1368bde 100644
---- a/setuptools/package_index.py
-+++ b/setuptools/package_index.py
-@@ -1,5 +1,6 @@
- """PyPI and direct package downloading."""
- 
-+import subprocess
- import sys
- import os
- import re
-@@ -881,17 +882,11 @@ class PackageIndex(Environment):
-         url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
- 
-         self.info("Doing git clone from %s to %s", url, filename)
--        os.system("git clone --quiet %s %s" % (url, filename))
-+        subprocess.check_call(["git", "clone", "--quiet", url, filename])
- 
-         if rev is not None:
-             self.info("Checking out %s", rev)
--            os.system(
--                "git -C %s checkout --quiet %s"
--                % (
--                    filename,
--                    rev,
--                )
--            )
-+            subprocess.check_call(["git", "-C", filename, "checkout", "--quiet", rev])
- 
-         return filename
- 
-@@ -900,17 +895,11 @@ class PackageIndex(Environment):
-         url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
- 
-         self.info("Doing hg clone from %s to %s", url, filename)
--        os.system("hg clone --quiet %s %s" % (url, filename))
-+        subprocess.check_call(["hg", "clone", "--quiet", url, filename])
- 
-         if rev is not None:
-             self.info("Updating to %s", rev)
--            os.system(
--                "hg --cwd %s up -C -r %s -q"
--                % (
--                    filename,
--                    rev,
--                )
--            )
-+            subprocess.check_call(["hg", "--cwd", filename, "up", "-C", "-r", rev, "-q"])
- 
-         return filename
- 
-diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
-index 0287063..c136e8d 100644
---- a/setuptools/tests/test_packageindex.py
-+++ b/setuptools/tests/test_packageindex.py
-@@ -190,37 +190,37 @@ class TestPackageIndex:
-         url = 'git+https://github.example/group/project@master#egg=foo'
-         index = setuptools.package_index.PackageIndex()
- 
--        with mock.patch("os.system") as os_system_mock:
-+        with mock.patch("subprocess.check_call") as subprocess_check_call_mock:
-             result = index.download(url, str(tmpdir))
- 
--        os_system_mock.assert_called()
-+        subprocess_check_call_mock.assert_called()
- 
-         expected_dir = str(tmpdir / 'project@master')
-         expected = (
-             'git clone --quiet ' 'https://github.example/group/project {expected_dir}'
--        ).format(**locals())
--        first_call_args = os_system_mock.call_args_list[0][0]
-+        ).format(**locals()).split()
-+        first_call_args = subprocess_check_call_mock.call_args_list[0][0]
-         assert first_call_args == (expected,)
- 
-         tmpl = 'git -C {expected_dir} checkout --quiet master'
--        expected = tmpl.format(**locals())
--        assert os_system_mock.call_args_list[1][0] == (expected,)
-+        expected = tmpl.format(**locals()).split()
-+        assert subprocess_check_call_mock.call_args_list[1][0] == (expected,)
-         assert result == expected_dir
- 
-     def test_download_git_no_rev(self, tmpdir):
-         url = 'git+https://github.example/group/project#egg=foo'
-         index = setuptools.package_index.PackageIndex()
- 
--        with mock.patch("os.system") as os_system_mock:
-+        with mock.patch("subprocess.check_call") as subprocess_check_call_mock:
-             result = index.download(url, str(tmpdir))
- 
--        os_system_mock.assert_called()
-+        subprocess_check_call_mock.assert_called()
- 
-         expected_dir = str(tmpdir / 'project')
-         expected = (
-             'git clone --quiet ' 'https://github.example/group/project {expected_dir}'
--        ).format(**locals())
--        os_system_mock.assert_called_once_with(expected)
-+        ).format(**locals()).split()
-+        subprocess_check_call_mock.assert_called_once_with(expected)
- 
-     def test_download_svn(self, tmpdir):
-         url = 'svn+https://svn.example/project#egg=foo'
--- 
-2.45.2
-

CVE-2025-47273.patch

@@ -1,30 +0,0 @@
-From ff1c62ede76e29a9d00bbbad266afa59ee153e51 Mon Sep 17 00:00:00 2001
-From: "Jason R. Coombs" <jaraco@jaraco.com>
-Date: Sat, 19 Apr 2025 13:03:47 -0400
-Subject: [PATCH] Add a check to ensure the name resolves relative to     the
- tmpdir.
-
-Closes #4946
-
----
- setuptools/package_index.py | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/setuptools/package_index.py b/setuptools/package_index.py
-index 1d3e5b4..79953f8 100755
---- a/setuptools/package_index.py
-+++ b/setuptools/package_index.py
-@@ -808,6 +808,10 @@ class PackageIndex(Environment):
- 
-         filename = os.path.join(tmpdir, name)
- 
-+        # ensure path resolves within the tmpdir
-+        if not filename.startswith(str(tmpdir)):
-+            raise ValueError("Invalid filename {filename}".format(filename = filename))
-+
-         # Download the file
-         #
-         if scheme == 'svn' or scheme.startswith('svn+'):
--- 
-2.49.0
-

SPECS/python3.12-setuptools.spec

@@ -24,7 +24,7 @@
 Name:           python%{python3_pkgversion}-setuptools
 # When updating, update the bundled libraries versions bellow!
 Version:        68.2.2
-Release:        5%{?dist}
+Release:        3%{?dist}
 Summary:        Easily build and distribute Python packages
 # setuptools is MIT
 # platformdirs is MIT
@@ -43,19 +43,6 @@ License:        MIT and ASL 2.0 and (BSD or ASL 2.0) and Python
 URL:            https://pypi.python.org/pypi/%{srcname}
 Source0:        %{pypi_source %{srcname} %{version}}
 
-# Security fix for CVE-2024-6345
-# Remote code execution via download functions in the package_index module
-# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2297771
-# Upstream solution: https://github.com/pypa/setuptools/pull/4332
-# Patch simplified because upstream doesn't support SVN anymore.
-Patch1:          CVE-2024-6345.patch
-
-# Security fix for CVE-2025-47273
-# Path traversal in PackageIndex.download leads to Arbitrary File Write
-# Upstream solution: https://github.com/pypa/setuptools/pull/4951/
-Patch2:          CVE-2025-47273.patch
-
-
 BuildArch:      noarch
 
 BuildRequires:  python%{python3_pkgversion}-devel
@@ -233,14 +220,6 @@ PYTHONPATH=$(pwd) %pytest \
 
 
 %changelog
-* Wed Jul 02 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 68.2.2-5
-- Security fix for CVE-2025-47273
-Resolves: RHEL-101131
-
-* Wed Jul 24 2024 Lumír Balhar <lbalhar@redhat.com> - 68.2.2-4
-- Security fix for CVE-2024-6345
-Resolves: RHEL-50475
-
 * Tue Jan 23 2024 Miro Hrončok <mhroncok@redhat.com> - 68.2.2-3
 - Rebuilt for timestamp .pyc invalidation mode
 

gating.yaml

@@ -1,8 +0,0 @@
---- !Policy
-
-product_versions:
-  - rhel-8
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
-

python3.12-setuptools.rpmlintrc

@@ -1,14 +0,0 @@
-# let's not report duplicate __init__s
-addFilter(r'W: files-duplicate .+__init__\.py ')
-
-# setuptools and pkg_resources have duplicated vendored libraries
-# we might want to de-duplicate this somehow in the future, but not yet
-# regex a bit complex to allow arbitrary order
-addFilter(r'W: files-duplicate .+/(setuptools/_vendor/.+ .+/pkg_resources|pkg_resources/_vendor/.+ .+/setuptools)/_vendor/')
-
-# When duplicate files are found, this errors is produced
-# as long as we filter out the warnings, we need to filter the error as well
-addFilter(r'E: files-duplicated-waste')
-
-# no %doc in the wheel packages
-addFilter(r'python-setuptools-wheel.noarch: (E|W): no-documentation')

sources

@@ -1 +0,0 @@
-SHA512 (setuptools-68.2.2.tar.gz) = ed3138a39e8ae47d695e71835024d66d63b8de51aa336bd8524de81a5036aa26cf587caca5d6b46c833f77a6e9c8c1ae6b64e8310f712bd9c4e760196778b2ca

tests/tests.yml

@@ -1,16 +0,0 @@
----
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    repositories:
-    - repo: "https://gitlab.com/redhat/centos-stream/tests/python.git"
-      dest: "python"
-    tests:
-    - smoke312:
-        dir: python/smoke
-        run: VERSION=3.12 TOX=false ./venv.sh
-    required_packages:
-    - gcc
-    - python3.12-devel