freedomofpress / securedrop-builder

Packaging logic for building SecureDrop-related Debian packages
GNU General Public License v3.0
7 stars 11 forks source link

Upgrade setuptools for CVE-2024-6345 #500

Closed legoktm closed 1 month ago

legoktm commented 1 month ago

Related: https://github.com/freedomofpress/securedrop/pull/7205

Upgrading setuptools is turning into cascading upgrades for everything, we also need to upgrade pip, and if you don't upgrade packaging, you'll hit https://github.com/pypa/setuptools/issues/4483. But packaging needs a newer version of flit-core, which triggers conflicts with pep517, so let's also upgrade build to drop that dependency.

legoktm commented 1 month ago

All of the subsequent wheels need to be rebuilt, because of differences metadata. For example, rebuilding securedrop-export/wheels/ptyprocess-0.7.0-py2.py3-none-any.whl:

pexpect-4.9.0.dist-info/METADATA

@@ -27,15 +27,16 @@
 Classifier: Topic :: Software Development :: Testing
 Classifier: Topic :: System
 Classifier: Topic :: System :: Archiving :: Packaging
 Classifier: Topic :: System :: Installation/Setup
 Classifier: Topic :: System :: Shells
 Classifier: Topic :: System :: Software Distribution
 Classifier: Topic :: Terminals
-Requires-Dist: ptyprocess (>=0.5)
+License-File: LICENSE
+Requires-Dist: ptyprocess >=0.5

 Pexpect is a pure Python module for spawning child applications; controlling
 them; and responding to expected patterns in their output. Pexpect works like
 Don Libes' Expect. Pexpect allows your script to spawn a child application and
 control it as if a human were typing commands.

@@ -45,9 +46,7 @@
 automated software testing. Pexpect is in the spirit of Don Libes' Expect, but
 Pexpect is pure Python.

 The main features of Pexpect require the pty module in the Python standard
 library, which is only available on Unix-like systems. Some features—waiting
 for patterns from file descriptors or subprocesses—are also available on
 Windows.
-
-

pexpect-4.9.0.dist-info/WHEEL

@@ -1,6 +1,6 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.36.2)
+Generator: setuptools (70.3.0)
 Root-Is-Purelib: true
 Tag: py2-none-any
 Tag: py3-none-any