pythonPackages.koji: 1.13.0 -> 1.14.3, addressing CVE-2019-17109 #72202
+7
−5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jonringer
reviewed
Oct 29, 2019
| @@ -2,12 +2,12 @@ | |||
|
|
|||
| buildPythonPackage rec { | |||
| pname = "koji"; | |||
| version = "1.13.0"; | |||
| version = "1.14.3"; | |||
| format = "other"; | |||
There was a problem hiding this comment.
still python2 only
Suggested change
| format = "other"; | |
| format = "other"; | |
| disabled = !isPy27; |
[nix-shell:~/.cache/nix-review/pr-72202]$ nix-shell --pure -p "with import ./nixpkgs {}; python3Packages.koji"
[nix-shell:~/.cache/nix-review/pr-72202]$ kojira --help
File "/nix/store/5h0gb4z3614ndgskmyc2j888dd5dkw1d-python3.7-koji-1.14.3/bin/.kojira-wrapped", line 150
except OSError, e:
^
SyntaxError: invalid syntax
There was a problem hiding this comment.
Possibly the committer in e1182f0 was made overly optimistic from the koji executable appearing to work in py3k. Fixed.
veprbl
added
the
1.severity: security
Addressing CVE-2019-17109 Also added missing description, homepage & license. Re-disabled for py3k as the kojira executable doesn't seem to be happy with it.
risicle
force-pushed
the
ris-koji-1.14.3
branch
from
58e7218 to
605a7b3
Compare
|
@ofborg build python27Packages.koji python36Packages.koji |
|
LGTM, let's merge! :) @risicle Could you open backport PRs to 19.03 and 19.09 with |
dtzWill
pushed a commit
to dtzWill/nixpkgs
that referenced
this pull request
Nov 4, 2019
pythonPackages.koji: 1.13.0 -> 1.14.3, addressing CVE-2019-17109 (cherry picked from commit 3376fd9)
This was referenced Nov 4, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
https://docs.pagure.org/koji/CVE-2019-17109/
Also added missing description, homepage & license - this package hasn't been touched in a long time and I have little clue about it other than what I looked up to fill out the metadata. Why didn't I bump to a newer release like 1.18.1? I assumed it would be more likely to cause breakage and I want to have as little to do to this package as possible.
The only in-tree user of this package is
pythonPackages.rpkg, which itself doesn't build at the moment becauseGitPython-3.0.4 not supported for interpreter python2.7. Though I expect it is just as out of date as this is and could be fixed by someone with more of a clue.Things done
sandboxinnix.confon non-NixOS)nix-shell -p nix-review --run "nix-review wip"./result/bin/)nix path-info -Sbefore and after)Notify maintainers
cc @