[Git][reproducible-builds/diffoscope][master] 3 commits: Temporarily fix support for Python 3.11.8. See #362.
Chris Lamb (@lamby)
gitlab at salsa.debian.org
Fri Feb 9 20:26:13 UTC 2024
Chris Lamb pushed to branch master at Reproducible Builds / diffoscope
Commits:
5e6cfbf0 by Chris Lamb at 2024-02-09T12:13:29-08:00
Temporarily fix support for Python 3.11.8. See #362.
- - - - -
0e7ebcde by Chris Lamb at 2024-02-09T12:14:33-08:00
Update copyright years.
- - - - -
dfed7699 by Chris Lamb at 2024-02-09T12:22:43-08:00
releasing package diffoscope version 256
- - - - -
6 changed files:
- debian/changelog
- diffoscope/__init__.py
- diffoscope/comparators/pgp.py
- diffoscope/external_tools.py
- tests/comparators/test_pgp.py
- tests/comparators/test_zip.py
Changes:
=====================================
debian/changelog
=====================================
@@ -1,8 +1,16 @@
-diffoscope (256) UNRELEASED; urgency=medium
-
- * WIP (generated upon release).
-
- -- Chris Lamb <lamby at debian.org> Fri, 26 Jan 2024 08:46:44 -0800
+diffoscope (256) unstable; urgency=high
+
+ * Use a determistic name when extracting content from GPG artifacts instead
+ of trusting the value of gpg's --use-embedded-filenames. This prevents a
+ potential information disclosure vulnerability that could have been
+ exploited by providing a specially-crafted GPG file with an embedded
+ filename of, say, "../../.ssh/id_rsa". Many thanks to Daniel Kahn Gillmor
+ <dkg at debian.org> for reporting this issue and providing feedback.
+ (Closes: reproducible-builds/diffoscope#361)
+ * Temporarily fix support for Python 3.11.8 re. a potential regression
+ with the handling of ZIP files. (See reproducible-builds/diffoscope#362)
+
+ -- Chris Lamb <lamby at debian.org> Fri, 09 Feb 2024 12:22:37 -0800
diffoscope (255) unstable; urgency=medium
=====================================
diffoscope/__init__.py
=====================================
@@ -17,4 +17,4 @@
# You should have received a copy of the GNU General Public License
# along with diffoscope. If not, see <https://www.gnu.org/licenses/>.
-VERSION = "255"
+VERSION = "256"
=====================================
diffoscope/comparators/pgp.py
=====================================
@@ -1,7 +1,7 @@
#
# diffoscope: in-depth comparison of files, archives, and directories
#
-# Copyright © 2017-2021 Chris Lamb <lamby at debian.org>
+# Copyright © 2017-2021, 2024 Chris Lamb <lamby at debian.org>
#
# diffoscope is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
=====================================
diffoscope/external_tools.py
=====================================
@@ -1,7 +1,7 @@
#
# diffoscope: in-depth comparison of files, archives, and directories
#
-# Copyright © 2017-2023 Chris Lamb <lamby at debian.org>
+# Copyright © 2017-2024 Chris Lamb <lamby at debian.org>
# Copyright © 2021 Jean-Romain Garnier <salsa at jean-romain.com>
#
# diffoscope is free software: you can redistribute it and/or modify
=====================================
tests/comparators/test_pgp.py
=====================================
@@ -1,7 +1,7 @@
#
# diffoscope: in-depth comparison of files, archives, and directories
#
-# Copyright © 2017, 2019-2020 Chris Lamb <lamby at debian.org>
+# Copyright © 2017, 2019-2020, 2024 Chris Lamb <lamby at debian.org>
#
# diffoscope is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
=====================================
tests/comparators/test_zip.py
=====================================
@@ -2,7 +2,7 @@
# diffoscope: in-depth comparison of files, archives, and directories
#
# Copyright © 2015 Jérémy Bobbio <lunar at debian.org>
-# Copyright © 2015-2020, 2022 Chris Lamb <lamby at debian.org>
+# Copyright © 2015-2020, 2022, 2024 Chris Lamb <lamby at debian.org>
#
# diffoscope is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -18,11 +18,12 @@
# along with diffoscope. If not, see <https://www.gnu.org/licenses/>.
import pytest
+import sys
from diffoscope.comparators.zip import ZipFile, MozillaZipFile, JmodJavaModule
from ..utils.data import load_fixture, assert_diff
-from ..utils.tools import skip_unless_tools_exist
+from ..utils.tools import skip_unless_tools_exist, skipif
from ..utils.nonexisting import assert_non_existing
@@ -84,6 +85,10 @@ def test_mozzip_identification(mozzip1):
assert isinstance(mozzip1, MozillaZipFile)
+ at skipif(
+ sys.version_info >= (3, 11, 8),
+ reason="Test fails under 3.11.8+; possible regression"
+)
def test_mozzip_no_differences(mozzip1):
difference = mozzip1.compare(mozzip1)
assert difference is None
@@ -95,11 +100,19 @@ def mozzip_differences(mozzip1, mozzip2):
@skip_unless_tools_exist("zipinfo")
+ at skipif(
+ sys.version_info >= (3, 11, 8),
+ reason="Test fails under 3.11.8+; possible regression"
+)
def test_mozzip_metadata(mozzip_differences, mozzip1, mozzip2):
assert_diff(mozzip_differences[0], "mozzip_zipinfo_expected_diff")
@skip_unless_tools_exist("zipinfo")
+ at skipif(
+ sys.version_info >= (3, 11, 8),
+ reason="Test fails under 3.11.8+; possible regression"
+)
def test_mozzip_compressed_files(mozzip_differences):
assert mozzip_differences[-1].source1 == "dir/text"
assert mozzip_differences[-1].source2 == "dir/text"
@@ -107,6 +120,10 @@ def test_mozzip_compressed_files(mozzip_differences):
@skip_unless_tools_exist("zipinfo")
+ at skipif(
+ sys.version_info >= (3, 11, 8),
+ reason="Test fails under 3.11.8+; possible regression"
+)
def test_mozzip_compare_non_existing(monkeypatch, mozzip1):
assert_non_existing(monkeypatch, mozzip1)
View it on GitLab: https://salsa.debian.org/reproducible-builds/diffoscope/-/compare/18d69030a4dc6a11f58ec2f1f6ade432d9625943...dfed769904c27d66a14a5903823d9c8c5aae860e
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/diffoscope/-/compare/18d69030a4dc6a11f58ec2f1f6ade432d9625943...dfed769904c27d66a14a5903823d9c8c5aae860e
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20240209/41162aad/attachment.htm>
More information about the rb-commits
mailing list