Accepting request 1269237 from devel:languages:python

- Add tests.patch to fix (some) tests with setuptools 77
- Skip license tests failing with setuptools 77

OBS-URL: https://build.opensuse.org/request/show/1269237
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-wheel?expand=0&rev=40

CVE-2026-24049.patch

@@ -1,126 +0,0 @@
-From 7a7d2de96b22a9adf9208afcc9547e1001569fef Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= <alex.gronholm@nextday.fi>
-Date: Thu, 22 Jan 2026 01:41:14 +0200
-Subject: [PATCH] Fixed security issue around wheel unpack (#675)
-
-A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered.
-
-Fixes CVE-2026-24049.
----
- docs/news.rst                 |  2 ++
- src/wheel/_commands/unpack.py |  4 ++--
- tests/commands/test_unpack.py | 23 +++++++++++++++++++++++
- 3 files changed, 27 insertions(+), 2 deletions(-)
-
-Index: wheel-0.42.0/src/wheel/cli/unpack.py
-===================================================================
---- wheel-0.42.0.orig/src/wheel/cli/unpack.py
-+++ wheel-0.42.0/src/wheel/cli/unpack.py
-@@ -19,12 +19,12 @@ def unpack(path: str, dest: str = ".") -
-         destination = Path(dest) / namever
-         print(f"Unpacking to: {destination}...", end="", flush=True)
-         for zinfo in wf.filelist:
--            wf.extract(zinfo, destination)
-+            target_path = Path(wf.extract(zinfo, destination))
- 
-             # Set permissions to the same values as they were set in the archive
-             # We have to do this manually due to
-             # https://github.com/python/cpython/issues/59999
-             permissions = zinfo.external_attr >> 16 & 0o777
--            destination.joinpath(zinfo.filename).chmod(permissions)
-+            target_path.chmod(permissions)
- 
-     print("OK")
-Index: wheel-0.42.0/tests/cli/test_unpack.py
-===================================================================
---- wheel-0.42.0.orig/tests/cli/test_unpack.py
-+++ wheel-0.42.0/tests/cli/test_unpack.py
-@@ -8,6 +8,7 @@ import pytest
- from wheel.cli.unpack import unpack
- from wheel.wheelfile import WheelFile
- 
-+from .util import run_command
- 
- def test_unpack(wheel_paths, tmp_path):
-     """
-@@ -34,3 +35,26 @@ def test_unpack_executable_bit(tmp_path)
-     unpack(str(wheel_path), str(tmp_path))
-     assert not script_path.is_dir()
-     assert stat.S_IMODE(script_path.stat().st_mode) == 0o755
-+
-+
-+@pytest.mark.skipif(
-+    platform.system() == "Windows", reason="Windows does not support chmod()"
-+)
-+def test_chmod_outside_unpack_tree(tmp_path_factory: TempPathFactory) -> None:
-+    wheel_path = tmp_path_factory.mktemp("build") / "test-1.0-py3-none-any.whl"
-+    with WheelFile(wheel_path, "w") as wf:
-+        wf.writestr(
-+            "test-1.0.dist-info/METADATA",
-+            "Metadata-Version: 2.4\nName: test\nVersion: 1.0\n",
-+        )
-+        wf.writestr("../../system-file", b"malicious data")
-+
-+    extract_root_path = tmp_path_factory.mktemp("extract")
-+    system_file = extract_root_path / "system-file"
-+    extract_path = extract_root_path / "subdir"
-+    system_file.write_bytes(b"important data")
-+    system_file.chmod(0o755)
-+    run_command("unpack", "--dest", extract_path, wheel_path)
-+
-+    assert system_file.read_bytes() == b"important data"
-+    assert stat.S_IMODE(system_file.stat().st_mode) == 0o755
-Index: wheel-0.42.0/tests/cli/util.py
-===================================================================
---- /dev/null
-+++ wheel-0.42.0/tests/cli/util.py
-@@ -0,0 +1,43 @@
-+from __future__ import annotations
-+
-+import sys
-+from io import StringIO
-+from os import PathLike
-+from subprocess import CalledProcessError
-+from unittest.mock import patch
-+
-+import pytest
-+
-+from wheel.cli import main
-+
-+
-+def run_command(
-+    command: str, *args: str | PathLike, catch_systemexit: bool = True
-+) -> str:
-+    returncode = 0
-+    stdout = StringIO()
-+    stderr = StringIO()
-+    args = ("wheel", command) + tuple(str(arg) for arg in args)
-+    with (
-+        patch.object(sys, "argv", args),
-+        patch.object(sys, "stdout", stdout),
-+        patch.object(sys, "stderr", stderr),
-+    ):
-+        try:
-+            main()
-+        except SystemExit as exc:
-+            if not catch_systemexit:
-+                raise CalledProcessError(
-+                    exc.code, args, stdout.getvalue(), stderr.getvalue()
-+                ) from exc
-+
-+            returncode = exc.code
-+
-+    if returncode:
-+        pytest.fail(
-+            f"'wheel {command}' exited with return code {returncode}\n"
-+            f"arguments: {args}\n"
-+            f"error output:\n{stderr.getvalue()}"
-+        )
-+
-+    return stdout.getvalue()
-Index: wheel-0.42.0/tests/cli/__init__.py
-===================================================================
---- /dev/null
-+++ wheel-0.42.0/tests/cli/__init__.py
-@@ -0,0 +1 @@
-+

python-wheel.changes

@@ -1,8 +1,3 @@
--------------------------------------------------------------------
-Wed Jan 28 09:12:46 UTC 2026 - Nico Krapp <nico.krapp@suse.com>
-
-- Add CVE-2026-24049.patch to fix CVE-2026-24049 (bsc#1257100)
-
 -------------------------------------------------------------------
 Thu Mar 27 10:29:43 UTC 2025 - Markéta Machová <mmachova@suse.com>
 

python-wheel.spec

@@ -40,9 +40,7 @@ Group:          Development/Languages/Python
 URL:            https://github.com/pypa/wheel
 Source:         https://github.com/pypa/wheel/archive/%{version}.tar.gz#/wheel-%{version}.tar.gz
 # PATCH-FIX-UPSTREAM https://github.com/pypa/wheel/pull/651 fix test failures
-Patch0:          tests.patch
+Patch:          tests.patch
-# PATCH-FIX-UPSTREAM CVE-2026-24049.patch bsc#1257100 gh#pypa/wheel@7a7d2de
-Patch1:         CVE-2026-24049.patch
 # Bootstrap: Don't BuildRequire setuptools or pip here!
 BuildRequires:  %{python_module base >= 3.8}
 BuildRequires:  %{python_module flit-core}