Sync from SUSE:SLFO:Main python-setuptools revision 3885fce38611e3f92b2b6c36f4bd11d7

CVE-2025-47273.patch

@@ -1,26 +0,0 @@
-From 250a6d17978f9f6ac3ac887091f2d32886fbbb0b Mon Sep 17 00:00:00 2001
-From: "Jason R. Coombs" <jaraco@jaraco.com>
-Date: Sat, 19 Apr 2025 13:03:47 -0400
-Subject: [PATCH] Add a check to ensure the name resolves relative to the
- tmpdir.
-
-Closes #4946
----
- setuptools/package_index.py | 18 ++++++++++++++++--
- 1 file changed, 16 insertions(+), 2 deletions(-)
-
-Index: setuptools-70.0.0/setuptools/package_index.py
-===================================================================
---- setuptools-70.0.0.orig/setuptools/package_index.py
-+++ setuptools-70.0.0/setuptools/package_index.py
-@@ -832,6 +832,10 @@ class PackageIndex(Environment):
- 
-         filename = os.path.join(tmpdir, name)
- 
-+        # ensure path resolves within the tmpdir
-+        if not filename.startswith(str(tmpdir)):
-+            raise ValueError(f"Invalid filename {filename}")
-+
-         return self._download_vcs(url, filename) or self._download_other(url, filename)
- 
-     @staticmethod

_multibuild

@@ -1,3 +1,4 @@
 <multibuild>
   <package>test</package>
+  <package>primary</package>
 </multibuild>

python-setuptools.changes

@@ -1,9 +1,281 @@
 -------------------------------------------------------------------
-Tue May 20 08:23:51 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+Tue May 13 15:45:23 UTC 2025 - Dirk Müller <dmueller@suse.com>
 
-- Add patch CVE-2025-47273.patch to fix A path traversal
+- update to 78.1.1:
-  vulnerability.
+  * More fully sanitized the filename in PackageIndex._download.
-  (bsc#1243313, CVE-2025-47273, gh#pypa/setuptools@250a6d17978f)
+- switch build-exclusion to be tumbleweed only
+
+-------------------------------------------------------------------
+Sun Mar 30 07:55:30 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- update to 78.1.0:
+  * Restore access to _get_vc_env with a warning.
+
+-------------------------------------------------------------------
+Mon Mar 24 17:42:46 UTC 2025 - Markéta Machová <mmachova@suse.com>
+
+- update to 78.0.2
+  * Reverted distutils changes that broke the monkey patching of command
+    classes.
+  * Temporarily remove requests from integration tests.
+
+-------------------------------------------------------------------
+Sat Mar 22 07:38:14 UTC 2025 - Adrian Schröter <adrian@suse.de>
+
+- update to 77.0.3:
+  * Temporarily convert error for license glob patterns containing
+    ../ into a deprecation warning to allow an accomodation period
+  * Better error messages for packaging.
+  * Avoided eagerly raising an exception when license-files is
+    defined simultaneously inside and outside of pyproject.toml.
+  * Added initial support for license expression (PEP 639)
+  * Store License-Files in .dist-info/licenses subfolder and
+    added support for recursive globs for license_files (PEP 639)
+  * Bump core metadata version to 2.4.
+  * Updated vendored copy of wheel to v0.45.1
+
+-------------------------------------------------------------------
+Tue Feb 25 20:32:51 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- update to 75.8.0:
+  * Implemented Dynamic field for core metadata (as introduced in
+    PEP 643). The existing implementation is currently
+    experimental and the exact approach may change in future
+    releases.
+  * Synced with pypa/distutils@c97a3db2f including better support
+    for free threaded Python on Windows (pypa/distutils#310),
+    improved typing support, and linter accommodations.
+  * Synced with pypa/distutils@ff11eed0c including bugfix for
+    duplicate CFLAGS and adaption to support Python 3.13 is_abs
+    in the C compiler (#4669).
+
+-------------------------------------------------------------------
+Thu Jan 16 01:55:52 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Also provide python3-setuptools-wheel for the primary flavor.
+
+-------------------------------------------------------------------
+Wed Jan 15 15:27:23 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Explicitly BuildRequire python-rpm-packaging: when primary flavor
+  is added, this is auto-installed by dependencies. But as we now
+  build the primary flavor separated, we have to ensure to also
+  have it present in the other cases, in order to get the python(abi)
+  dependencies added.
+
+-------------------------------------------------------------------
+Wed Jan 15 05:49:12 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Split out the primary Python build.
+
+-------------------------------------------------------------------
+Fri Nov 22 08:40:51 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- remove duplicated "uses_network" skip
+
+-------------------------------------------------------------------
+Thu Nov 21 12:01:23 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
+
+- Skip over the tests which require network.
+- Don't use pytest-xdist, it breaks test suite.
+
+-------------------------------------------------------------------
+Thu Nov 21 11:35:52 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 75.6.0:
+  * Preserve original PKG-INFO into METADATA when creating wheel
+    (instead of calling wheel.metadata.pkginfo_to_metadata). This
+    helps to be more compliant with the flow specified in PEP
+    517.
+  * Changed the WindowsSdkVersion, FrameworkVersion32 and
+    FrameworkVersion64 properties of setuptools.msvc.PlatformInfo
+    to return an empty tuple instead of None as a fallthrough
+    case --  by :user:`Avasam`
+
+-------------------------------------------------------------------
+Wed Nov 20 17:30:46 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 75.5.0:
+  * Removed support for
+    SETUPTOOLS_DANGEROUSLY_SKIP_PYPROJECT_VALIDATION, as it is
+    deemed prone to errors.
+  * Added support for the environment variable
+    SETUPTOOLS_DANGEROUSLY_SKIP_PYPROJECT_VALIDATION=true,
+    allowing users to bypass the validation of pyproject.toml.
+    This option should be used only as a last resort when
+    resolving dependency issues, as it may lead to improper
+    functioning. Users who enable this setting are responsible
+    for ensuring that pyproject.toml complies with setuptools
+    requirements. (#4611)  Attention! This environment variable
+    was removed in a later version of setuptools.
+  * Require Python 3.9 or later. (#4718)
+  * Remove dependency on importlib_resources and the vendored
+    copy of the library. Instead, setuptools consistently rely on
+    stdlib's importlib.resources (available on Python 3.9+).
+    (#4718)
+  * Setuptools' bdist_wheel implementation no longer produces
+    wheels with the m SOABI flag (pymalloc-related). This flag
+    was removed on Python 3.8+ (see :obj:`sys.abiflags`). (#4718)
+  * Updated vendored packaging version to 24.2. (#4740)
+  * Merge with pypa/distutils@251797602, including fix for
+    dirutil.mkpath handling in pypa/distutils#304.
+  * Allowed using dict as an ordered type in
+    setuptools.dist.check_requirements -- by :user:`Avasam`
+  * Ensured methods in setuptools.modified preferably raise a
+    consistent distutils.errors.DistutilsError type (except in
+    the deprecated use case of SETUPTOOLS_USE_DISTUTILS=stdlib)
+    -- by :user:`Avasam`
+  * Fix the ABI tag when building a wheel using the debug build
+    of Python 3.13 on Windows. Previously, the ABI tag was
+    missing the "d" flag.
+  * Fix clashes for optional-dependencies in pyproject.toml and
+    extra_requires in setup.cfg/setup.py. As per PEP 621,
+    optional-dependencies have to be honoured and dynamic
+    behaviour is not allowed.
+  * #4560
+  * Made errors when parsing Distribution data more explicit
+    about the expected type (tuple[str, ...] | list[str]) -- by
+    :user:`Avasam`
+  * Fix a TypeError when a Distribution's old included attribute
+    was a tuple -- by :user:`Avasam`
+  * Add workaround for bdist_wheel --dist-info-dir errors when
+    customisation does not inherit from setuptools.
+  * Re-use pre-existing .dist-info dir when creating wheels via
+    the build backend APIs (PEP 517) and the metadata_directory
+    argument is passed -- by :user:`pelson`.
+  * Changed egg_info command to avoid adding an empty .egg-info
+    directory while iterating over entry-points. This avoids
+    triggering integration problems with
+    importlib.metadata/importlib_metadata (reference:
+    pypa/pyproject-hooks#206).
+  * Deprecated bdist_wheel.universal configuration.
+  * Removed reference to upload_docs module in entry points.
+  * Declare also the dependencies used by distutils (adds
+    jaraco.collections).
+  * Removed upload_docs command.
+  * Merge with pypa/distutils@7283751. Removed the register and
+    upload commands and the config module that backs them
+    (pypa/distutils#294). Removed the borland compiler. Replaced
+    vendored dependencies with natural dependencies. Cygwin C
+    compiler now gets compilers from sysconfig
+    (pypa/distutils#296).
+  * Fix cross-platform compilation using
+    distutils._msvccompiler.MSVCCompiler -- by :user:`saschanaz`
+    and :user:`Avasam`
+  * Fixed TypeError in sdist filelist processing by adding
+    support for pathlib Paths for the build_base.
+  * Removed degraded and deprecated test_integration
+    (easy_install) from the test suite.
+  * Fixed TypeError in msvc.EnvironmentInfo.return_env when no
+    runtime redistributables are installed.
+  * Added support for defining ext-modules via pyproject.toml
+    (EXPERIMENTAL, may change in future releases).
+  * Merge with pypa/distutils@3dcdf8567, removing the duplicate
+    vendored copy of packaging.
+  * Restored setuptools.msvc.Environmentinfo as it is used
+    externally.
+  * Changed the type of error raised by
+    setuptools.command.easy_install.CommandSpec.from_param on
+    unsupported argument from AttributeError to TypeError -- by
+    :user:`Avasam`
+  * Added detection of ARM64 variant of MSVC -- by
+    :user:`saschanaz`
+  * Made setuptools.package_index.Credential a typing.NamedTuple
+    -- by :user:`Avasam`
+  * Reraise error from setuptools.command.easy_install.auto_chmod
+    instead of nonsensical TypeError: 'Exception' object is not
+    subscriptable -- by :user:`Avasam`
+  * Fully typed all collection attributes in pkg_resources -- by
+    :user:`Avasam`
+  * Automatically exclude .tox|.nox|.venv directories from sdist.
+  * Removed the monkeypatching of distutils._msvccompiler. Now
+    all compiler logic is consolidated in distutils.
+  * Synced with pypa/distutils@58fe058e4, including consolidating
+    Visual Studio 2017 support (#4600, pypa/distutils#289),
+    removal of deprecated legacy MSVC compiler modules
+    (pypa/distutils#287), suppressing of errors when the home
+    directory is missing (pypa/distutils#278), removal of wininst
+    binaries (pypa/distutils#282).
+  * #4592
+  * Remove abc.ABCMeta metaclass from abstract classes.
+    pypa/setuptools#4503 had an unintended consequence of causing
+    potential TypeError: metaclass conflict: the metaclass of a
+    derived class must be a (non-strict) subclass of the
+    metaclasses of all its bases -- by :user:`Avasam`
+  * Mark abstract base classes and methods with abc.ABC and
+    abc.abstractmethod -- by :user:`Avasam`
+  * Changed the order of type checks in
+    setuptools.command.easy_install.CommandSpec.from_param to
+    support any collections.abc.Iterable of str param -- by
+    :user:`Avasam`
+  * Prevent an error in bdist_wheel if compression is set to a
+    str (even if valid) after finalizing options but before
+    running the command. -- by :user:`Avasam`
+  * Raises an exception when py_limited_api is used in a build
+    with Py_GIL_DISABLED. This is currently not supported
+    (python/cpython#111506).
+  * Synced with pypa/distutils@30b7331 including fix for modified
+    check on empty sources (pypa/distutils#284).
+  * setuptools is replacing the usages of :pypi:`ordered_set`
+    with simple instances of dict[Hashable, None]. This is done
+    to remove the extra dependency and it is possible because
+    since Python 3.7, dict maintain insertion order.
+  * #4534, #4546, #4554, #4559, #4565
+  * Merged with pypa/distutils@b7ee725f3 including: Support for
+    Pathlike objects in data files and extensions
+    (pypa/distutils#272, pypa/distutils#237), native support for
+    C++ compilers (pypa/distuils#228) and removed unused
+    get_msvcr() (pypa/distutils#274).
+
+-------------------------------------------------------------------
+Fri Sep 13 04:01:00 UTC 2024 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Remove BuildRequires on wheel, it has been adopted since 71.1.
+- Sort out test suite changes.
+
+-------------------------------------------------------------------
+Tue Jul 30 02:22:34 UTC 2024 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Update to 72.1.0:
+  * Restore the tests command and deprecate access to the module.
+  * Added return types to typed public functions.
+  * Removed lingering unused code around Distribution._patched_dist.
+  * Reset the backports module when enabling vendored packages.
+  * Include all vendored files in the sdist.
+  * Restored package data that went missing in 71.0. This change also
+    incidentally causes tests to be installed once again.
+  * Now setuptools declares its own dependencies in the core extra.
+    Dependencies are still vendored for bootstrapping purposes, but
+    setuptools will prefer installed dependencies if present. The core
+    extra is used for informational purposes and should *not* be declared
+    in package metadata (e.g. build-requires).
+  * Support for loading distutils from the standard library is now
+    deprecated, including use of SETUPTOOLS_USE_DISTUTILS=stdlib and
+    importing distutils before importing setuptools.
+  * Fix distribution name normalisation for valid versions that are not
+    canonical (e.g. 1.0-2).
+
+-------------------------------------------------------------------
+Sat Jun 29 05:45:24 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 70.1.1:
+  * Improve error message when pkg_resources.ZipProvider tries to
+    extract resources with a missing Egg
+    Added variables and parameter type annotations to
+    pkg_resources to be nearly on par with typeshed.*
+  * Improve error message when pkg_resources.ZipProvider tries to
+    extract resources with a missing Egg
+  * Added variables and parameter type annotations to
+    pkg_resources to be nearly on par with typeshed.*
+  * Migrated Setuptools' own config to pyproject.toml
+  * Prevent a TypeError: 'NoneType' object is not callable when
+    shutil_rmtree is called without an onexc parameter on
+    Python<=3.11
+  * Replace use of mktemp with can_symlink from the stdlib test
+    suite.
+  * Improvement for attr: directives in configuration to handle
+    more edge cases related to complex package_dir.
+  * Fix accidental implicit string concatenation.
 
 -------------------------------------------------------------------
 Tue May 28 05:20:31 UTC 2024 - Steve Kowalik <steven.kowalik@suse.com>

python-setuptools.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-setuptools
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,10 +16,32 @@
 #
 
 
-%define skip_python2 1
 %global flavor @BUILD_FLAVOR@%{nil}
+%if 0%{?suse_version} >= 1650
+%if "%{flavor}" == "primary"
+# this one is goes into Ring0:  Bootstrap for primary python stack
+%define pprefix %{primary_python}
+%define pythons %{primary_python}
+%define psuffix %{nil}
+%endif
+%if "%{flavor}" == ""
+# The rest is in Ring1
+%define pprefix python
+%{expand:%%define skip_%{primary_python} 1}
+%define psuffix %{nil}
+%endif
+%else
+# backport and option d projects for 15.X having one or more python in the buildset don't need the Ring split for bootstrap
+%if "%{flavor}" == "primary"
+%define python_module() invalid-multibuild-flavor-for-15.X
+ExclusiveArch:  do-not-build
+%else
+%define pprefix python
+%endif
+%endif
 %if "%{flavor}" == "test"
 %define psuffix -test
+%define pprefix python
 %bcond_without test
 %endif
 %if "%{flavor}" == ""
@@ -30,22 +52,19 @@
 # in order to avoid rewriting for subpackage generator
 %define mypython python
 %{?sle15_python_module_pythons}
-Name:           python-setuptools%{psuffix}
+Name:           %{pprefix}-setuptools%{psuffix}
-Version:        70.0.0
+Version:        78.1.1
 Release:        0
 Summary:        Download, build, install, upgrade, and uninstall Python packages
 License:        Apache-2.0 AND MIT AND BSD-2-Clause AND Python-2.0
 URL:            https://github.com/pypa/setuptools
 Source:         https://files.pythonhosted.org/packages/source/s/setuptools/setuptools-%{version}.tar.gz
 Patch0:         sort-for-reproducibility.patch
-# PATCH-FIX-UPSTREAM CVE-2025-47273.patch bsc#1243313, gh#pypa/setuptools@250a6d17978f
-Patch1:         CVE-2025-47273.patch
 # Bootstrap: Don't BuildRequire pip here!
 BuildRequires:  %{python_module base >= 3.9}
-# The rpm python-wheel build is bootstrap friendly since 0.42
-BuildRequires:  %{python_module wheel >= 0.42}
 BuildRequires:  fdupes
 BuildRequires:  python-rpm-macros
+BuildRequires:  python-rpm-packaging
 Requires(post): update-alternatives
 Requires(postun): update-alternatives
 BuildArch:      noarch
@@ -53,18 +72,19 @@ BuildArch:      noarch
 BuildRequires:  %{python_module build}
 BuildRequires:  %{python_module devel}
 BuildRequires:  %{python_module filelock >= 3.4.0}
-BuildRequires:  %{python_module ini2toml-lite >= 0.9}
+BuildRequires:  %{python_module ini2toml-lite >= 0.14}
 BuildRequires:  %{python_module jaraco.develop >= 7.21}
 BuildRequires:  %{python_module jaraco.envs >= 2.2}
+BuildRequires:  %{python_module jaraco.packaging >= 9.3}
 BuildRequires:  %{python_module jaraco.path >= 3.2.0}
-BuildRequires:  %{python_module packaging}
+BuildRequires:  %{python_module jaraco.test >= 5.5}
+BuildRequires:  %{python_module packaging >= 24.2}
 BuildRequires:  %{python_module pip >= 19.1}
-BuildRequires:  %{python_module pip-run >= 8.8}
 BuildRequires:  %{python_module pytest >= 6}
-BuildRequires:  %{python_module pytest-home}
+BuildRequires:  %{python_module pytest-home >= 0.5}
 BuildRequires:  %{python_module pytest-subprocess}
 BuildRequires:  %{python_module pytest-timeout}
-BuildRequires:  %{python_module pytest-xdist}
+# BuildRequires:  %%{python_module pytest-xdist >= 3}
 BuildRequires:  %{python_module setuptools = %{version}}
 BuildRequires:  %{python_module setuptools-wheel = %{version}}
 BuildRequires:  %{python_module tomli-w >= 1.0.0}
@@ -73,6 +93,9 @@ BuildRequires:  %{python_module virtualenv >= 13.0.0}
 %if 0%{?suse_version} || 0%{?fedora_version} >= 24
 Recommends:     ca-certificates-mozilla
 %endif
+%if "%{flavor}" == "primary"
+Provides:       %{mypython}3-setuptools = %{version}-%{release}
+%endif
 %python_subpackages
 
 %description
@@ -83,6 +106,9 @@ especially ones that have dependencies on other packages.
 %package wheel
 Summary:        The setuptools wheel for custom tests and install requirements
 Requires:       %mypython(abi) = %python_version
+%if "%{flavor}" == "primary"
+Provides:       %{mypython}3-setuptools-wheel = %{version}-%{release}
+%endif
 
 %description wheel
 This packages provides the setuptools wheel as separate file for cases where
@@ -95,7 +121,7 @@ the wheel needs to be used directly in test or install setups
 rm -f setuptools/*.exe
 
 %build
-%if !%{with test}
+%if %{without test}
 %{python_expand # bootstrap with built-in pip
 $python -m venv build/env
 build/env/bin/python -m ensurepip
@@ -105,7 +131,7 @@ export PYTHONPATH=build/env/lib/python%{$python_bin_suffix}/site-packages
 %endif
 
 %install
-%if !%{with test}
+%if %{without test}
 %{python_expand # use pip bootstrapped above
 export PYTHONPATH=build/env/lib/python%{$python_bin_suffix}/site-packages
 %{$python_pyproject_install}
@@ -122,20 +148,24 @@ cp %{$python_sitelib}/../wheels/setuptools-%{version}-py3-none-any.whl $PWD/dist
 }
 export PRE_BUILT_SETUPTOOLS_WHEEL=$PWD/dist/setuptools-%{version}-py3-none-any.whl
 export LANG=en_US.UTF-8
+export PIP_FIND_LINKS=$PWD/dist
 # tests need imports from local source dir
 export PYTHONPATH=$(pwd)
 # no online comparisons in obs
 donttest="(test_apply_pyproject_equivalent_to_setupcfg and https)"
 # test_pbr_integration tries to install pbr from network using pip
 donttest+=" or test_pbr_integration"
-# test_example_file_in_sdist wants wheel.whl
+# looks for .exe files that we do not ship
-donttest+=" or test_example_file_in_sdist"
+donttest+=" or test_wheel_includes_cli_scripts"
-# Failing doctest: AttributeError: 'Path' object has no attribute 'iterdir'
+# ignores environment variables
-donttest+=" or yield_top_level"
+donttest+=" or test_setup_requires_with_distutils_command_dep"
-%pytest -rfE -n auto -k "not ($donttest)"
+donttest+=" or test_setup_requires_with_transitive_extra_dependency"
+# skip tests that require network access
+donttest+=" or uses_network"
+%pytest -rfE -k "not ($donttest)"
 %endif
 
-%if !%{with test}
+%if %{without test}
 %files %{python_files}
 %if !%{with wheel}
 %license LICENSE

sort-for-reproducibility.patch

@@ -1,15 +1,10 @@
 ---
  setuptools/command/easy_install.py |    2 +-
- setuptools/command/egg_info.py     |    2 +-
- setuptools/dist.py                 |    2 +-
- setuptools/tests/test_egg_info.py  |    2 +-
  setuptools/tests/test_wheel.py     |    8 ++++----
- 5 files changed, 8 insertions(+), 8 deletions(-)
+ 2 files changed, 5 insertions(+), 5 deletions(-)
 
-Index: setuptools-70.0.0/setuptools/command/easy_install.py
+--- a/setuptools/command/easy_install.py
-===================================================================
++++ b/setuptools/command/easy_install.py
---- setuptools-70.0.0.orig/setuptools/command/easy_install.py
-+++ setuptools-70.0.0/setuptools/command/easy_install.py
 @@ -436,7 +436,7 @@ class easy_install(Command):
              for spec in self.args:
                  self.easy_install(spec, not self.no_deps)
@@ -19,11 +14,9 @@ Index: setuptools-70.0.0/setuptools/command/easy_install.py
                  if self.root:  # strip any package prefix
                      root_len = len(self.root)
                      for counter in range(len(outputs)):
-Index: setuptools-70.0.0/setuptools/tests/test_wheel.py
+--- a/setuptools/tests/test_wheel.py
-===================================================================
++++ b/setuptools/tests/test_wheel.py
---- setuptools-70.0.0.orig/setuptools/tests/test_wheel.py
+@@ -417,30 +417,30 @@ WHEEL_INSTALL_TESTS: tuple[dict[str, Any
-+++ setuptools-70.0.0/setuptools/tests/test_wheel.py
-@@ -411,30 +411,30 @@ WHEEL_INSTALL_TESTS = (
      dict(
          id='requires_ensure_order',
          install_requires="""