Difuse/packages
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
packages/lang/python/python3/patches-setuptools/003-PKG-INFO-output-reproducible.patch

15 lines
496 B
Diff
Raw Normal View History

python-setuptools: Add reproducibility patches from Debian This adds the ability to patch setuptools (and pip), and adds 3 reproducibility patches from Debian[1]. (003-PKG-INFO-output-reproducible.patch addresses the issue identified in #9039.) The patching is not perfect, in that the patches are applied to setuptools and pip after they have been installed, since they are installed from wheels which are already "precompiled". Also, patching for the host install cannot be updated in place, for example if a patch is added or removed. [1]: https://sources.debian.org/patches/python-setuptools/40.8.0-1/ Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-05-24 05:18:09 +00:00
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894215
https://sources.debian.org/patches/python-setuptools/40.8.0-1/PKG-INFO-output-reproducible.diff/
--- a/setuptools/dist.py
+++ b/setuptools/dist.py
python3: Update to 3.8.4, refresh/rework patches, backport patches This version includes fixes for: * CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface * CVE-2020-15523: Python uses invalid DLL path after calling Py_SetPath on Windows This version also includes support for OpenSSL 1.1.x builds that use 'no-deprecated' and '--api=1.1.0'[1], and so this removes the previous OpenSSL-related patches. This also backports fixes for security issues, including: * CVE-2019-20907: Infinite loop in the tarfile module This also updates the setuptools and pip packages to 47.1.0 and 20.1.1, respectively. [1]: https://github.com/python/cpython/pull/20566 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2020-07-19 21:48:57 +00:00
@@ -193,7 +193,7 @@ def write_pkg_file(self, file):
python-setuptools: Add reproducibility patches from Debian This adds the ability to patch setuptools (and pip), and adds 3 reproducibility patches from Debian[1]. (003-PKG-INFO-output-reproducible.patch addresses the issue identified in #9039.) The patching is not perfect, in that the patches are applied to setuptools and pip after they have been installed, since they are installed from wheels which are already "precompiled". Also, patching for the host install cannot be updated in place, for example if a patch is added or removed. [1]: https://sources.debian.org/patches/python-setuptools/40.8.0-1/ Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-05-24 05:18:09 +00:00
self.long_description_content_type
)
if self.provides_extras:
- for extra in self.provides_extras:
+ for extra in sorted(self.provides_extras):
write_field('Provides-Extra', extra)
Reference in a new issue Copy permalink