Sync from SUSE:SLFO:Main python-certifi revision 31ef5f41c16d76cca10028f716bed50a

python-certifi-shipped-requests-cabundle.patch

@@ -1,21 +1,28 @@
-diff -Nru certifi-2022.9.24.orig/certifi/core.py certifi-2022.9.24/certifi/core.py
+Index: certifi-2024.7.4/certifi/core.py
---- certifi-2022.9.24.orig/certifi/core.py	2022-09-13 22:15:32.000000000 +0200
+===================================================================
-+++ certifi-2022.9.24/certifi/core.py	2022-11-15 12:56:32.415823730 +0100
+--- certifi-2024.7.4.orig/certifi/core.py
-@@ -3,106 +3,18 @@
++++ certifi-2024.7.4/certifi/core.py
+@@ -3,112 +3,19 @@ certifi.py
  ~~~~~~~~~~
  
  This module returns the installation location of cacert.pem or its contents.
--"""
--import sys
--
- 
--if sys.version_info >= (3, 11):
 +Patched by openSUSE: return the system bundle
-+"""
+ """
- 
+-import sys
--    from importlib.resources import as_file, files
+-import atexit
 +import io
  
+-def exit_cacert_ctx() -> None:
+-    _CACERT_CTX.__exit__(None, None, None)  # type: ignore[union-attr]
+ 
++def read_text(_module=None, _path=None, encoding="ascii"):
++    with io.open(where(), "r", encoding=encoding) as data:
++        return data.read()
+ 
+-if sys.version_info >= (3, 11):
+ 
+-    from importlib.resources import as_file, files
+-
 -    _CACERT_CTX = None
 -    _CACERT_PATH = None
 -
@@ -40,6 +47,7 @@ diff -Nru certifi-2022.9.24.orig/certifi/core.py certifi-2022.9.24/certifi/core.
 -            # we will also store that at the global level as well.
 -            _CACERT_CTX = as_file(files("certifi").joinpath("cacert.pem"))
 -            _CACERT_PATH = str(_CACERT_CTX.__enter__())
+-            atexit.register(exit_cacert_ctx)
 -
 -        return _CACERT_PATH
 -
@@ -75,6 +83,7 @@ diff -Nru certifi-2022.9.24.orig/certifi/core.py certifi-2022.9.24/certifi/core.
 -            # we will also store that at the global level as well.
 -            _CACERT_CTX = get_path("certifi", "cacert.pem")
 -            _CACERT_PATH = str(_CACERT_CTX.__enter__())
+-            atexit.register(exit_cacert_ctx)
 -
 -        return _CACERT_PATH
 -
@@ -106,14 +115,11 @@ diff -Nru certifi-2022.9.24.orig/certifi/core.py certifi-2022.9.24/certifi/core.
 -    # of assuming we're on the filesystem and munge the path directly.
 -    def where() -> str:
 -        f = os.path.dirname(__file__)
-+def read_text(_module=None, _path=None, encoding="ascii"):
-+    with io.open(where(), "r", encoding=encoding) as data:
-+        return data.read()
- 
--        return os.path.join(f, "cacert.pem")
 +def where():
 +    return "/etc/ssl/ca-bundle.pem"
  
+-        return os.path.join(f, "cacert.pem")
+ 
 -    def contents() -> str:
 -        return read_text("certifi", "cacert.pem", encoding="ascii")
 +def contents() -> str:

python-certifi.changes

@@ -1,3 +1,40 @@
+-------------------------------------------------------------------
+Tue Jul  9 06:36:13 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Refresh patches python-certifi-shipped-requests-cabundle.patch and
+  two-basic-unit-tests.patch
+- Remove executable bit from core.py file
+- Update to 2024.7.4 (CVE-2024-39689, bsc#1227519):
+  Removed certs:
+  * Subject: CN=GLOBALTRUST 2020 O=e-commerce monitoring GmbH
+
+- 2024.06.02
+  Added certs:
+  * Subject: CN=FIRMAPROFESIONAL CA ROOT-A WEB O=Firmaprofesional SA
+
+- 2024.02.02
+  Added certs:
+  * Subject: CN=Telekom Security TLS ECC Root 2020 O=Deutsche Telekom Security GmbH
+  * Subject: CN=Telekom Security TLS RSA Root 2023 O=Deutsche Telekom Security GmbH
+  Removed certs:
+  * Subject: O=SECOM Trust.net OU=Security Communication RootCA1
+
+  * Fix leaking certificate issue
+
+-------------------------------------------------------------------
+Tue Nov 28 09:10:25 UTC 2023 - Dirk Müller <dmueller@suse.com>
+
+- update to 2023.11.17:
+  Added certs:
+  * Subject: CN=TrustAsia Global Root CA G3 O=TrustAsia Technologies, Inc.
+  * Subject: CN=TrustAsia Global Root CA G4 O=TrustAsia Technologies, Inc.
+  * Subject: CN=CommScope Public Trust ECC Root-01 O=CommScope
+  * Subject: CN=CommScope Public Trust ECC Root-02 O=CommScope
+  * Subject: CN=CommScope Public Trust RSA Root-01 O=CommScope
+  * Subject: CN=CommScope Public Trust RSA Root-02 O=CommScope
+  Removed certs:
+  * Subject: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
+
 -------------------------------------------------------------------
 Wed Aug  9 07:54:58 UTC 2023 - Dirk Müller <dmueller@suse.com>
 
@@ -98,13 +135,13 @@ Thu Jun 17 20:53:23 UTC 2021 - Dirk Müller <dmueller@suse.com>
 -------------------------------------------------------------------
 Sat Dec 19 10:43:30 UTC 2020 - Dirk Müller <dmueller@suse.com>
 
-- update to 2020.12.5 
+- update to 2020.12.5
 
 -------------------------------------------------------------------
 Thu Nov 26 09:21:35 UTC 2020 - Dirk Mueller <dmueller@suse.com>
 
 - update to 2020.11.8:
-  * Python 3.8+ support 
+  * Python 3.8+ support
 
 -------------------------------------------------------------------
 Wed Nov 25 11:41:29 UTC 2020 - Matej Cepl <mcepl@suse.com>
@@ -188,7 +225,7 @@ Tue Jan  8 23:55:51 UTC 2019 - Jonathan Brownell <jbrownell@suse.com>
 
 - Limit SUSE certificate patch to exclude Red Hat platforms since
   the relevant /etc/ssl/ca-bundle.pem does not exist there
-  
+
 - %py_compile and %py3_compile macros do not exist on Red Hat;
   substitute them with equivalent %python_exec invocations
 

python-certifi.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-certifi
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,10 +16,9 @@
 #
 
 
-%{?!python_module:%define python_module() python-%{**} python3-%{**}}
 %{?sle15_python_module_pythons}
 Name:           python-certifi
-Version:        2023.7.22
+Version:        2024.7.4
 Release:        0
 Summary:        Python package for providing Mozilla's CA Bundle
 License:        MPL-2.0
@@ -57,8 +56,7 @@ Note that on SUSE packages the used CA bundle is actually the system bundle
 %install
 %python_install
 
-%{python_expand chmod +x %{buildroot}%{$python_sitelib}/certifi/core.py
+%{python_expand #
- sed -i "s|#!%{_bindir}/env python|#!%__$python|" %{buildroot}/%{$python_sitelib}/certifi/core.py
  rm %{buildroot}%{$python_sitelib}/certifi/cacert.pem
 }
 

two-basic-unit-tests.patch

@@ -11,14 +11,18 @@ Subject: [PATCH 1/2] add 2 basic unit tests
  create mode 100644 certifi/tests/__init__.py
  create mode 100755 certifi/tests/test_certifi.py
 
+Index: certifi-2024.7.4/certifi/tests/__init__.py
+===================================================================
 --- /dev/null
-+++ b/certifi/tests/__init__.py
++++ certifi-2024.7.4/certifi/tests/__init__.py
 @@ -0,0 +1,2 @@
 +# certifi.tests module
 +
+Index: certifi-2024.7.4/certifi/tests/test_certifi.py
+===================================================================
 --- /dev/null
-+++ b/certifi/tests/test_certifi.py
++++ certifi-2024.7.4/certifi/tests/test_certifi.py
-@@ -0,0 +1,19 @@
+@@ -0,0 +1,23 @@
 +# -*- coding: utf-8 -*-
 +"""
 +unit tests to make sure everything behaves as expected
@@ -31,15 +35,21 @@ Subject: [PATCH 1/2] add 2 basic unit tests
 +
 +
 +class TestCertifi(unittest.TestCase):
-+    def test_cabundle_exists(self):
++    def test_cabundle_exists(self) -> None:
-+        """Check that the reported bundle exists"""
++        assert os.path.exists(certifi.where())
-+        self.assertTrue(os.path.exists(certifi.where()))
 +
-+    def test_read_contents(self):
++    def test_read_contents(self) -> None:
-+        """Check that the returned contents contain a certificate"""
++        content = certifi.contents()
-+        self.assertIn("-----BEGIN CERTIFICATE-----", certifi.contents())
++        assert "-----BEGIN CERTIFICATE-----" in content
++
++    def test_py_typed_exists(self) -> None:
++        assert os.path.exists(
++            os.path.join(os.path.dirname(certifi.__file__), 'py.typed')
++        )
+Index: certifi-2024.7.4/.github/workflows/python-package.yml
+===================================================================
 --- /dev/null
-+++ b/.github/workflows/python-package.yml
++++ certifi-2024.7.4/.github/workflows/python-package.yml
 @@ -0,0 +1,40 @@
 +# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
 +# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions