Add CVE-2026-24049.patch to fix CVE-2026-24049 (bsc#1257100)

- Add tests.patch to fix (some) tests with setuptools 77
- Skip license tests failing with setuptools 77

OBS-URL: https://build.opensuse.org/request/show/1269237
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-wheel?expand=0&rev=40

CVE-2026-24049.patch

@@ -0,0 +1,126 @@
+From 7a7d2de96b22a9adf9208afcc9547e1001569fef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= <alex.gronholm@nextday.fi>
+Date: Thu, 22 Jan 2026 01:41:14 +0200
+Subject: [PATCH] Fixed security issue around wheel unpack (#675)
+
+A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered.
+
+Fixes CVE-2026-24049.
+---
+ docs/news.rst                 |  2 ++
+ src/wheel/_commands/unpack.py |  4 ++--
+ tests/commands/test_unpack.py | 23 +++++++++++++++++++++++
+ 3 files changed, 27 insertions(+), 2 deletions(-)
+
+Index: wheel-0.42.0/src/wheel/cli/unpack.py
+===================================================================
+--- wheel-0.42.0.orig/src/wheel/cli/unpack.py
++++ wheel-0.42.0/src/wheel/cli/unpack.py
+@@ -19,12 +19,12 @@ def unpack(path: str, dest: str = ".") -
+         destination = Path(dest) / namever
+         print(f"Unpacking to: {destination}...", end="", flush=True)
+         for zinfo in wf.filelist:
+-            wf.extract(zinfo, destination)
++            target_path = Path(wf.extract(zinfo, destination))
+ 
+             # Set permissions to the same values as they were set in the archive
+             # We have to do this manually due to
+             # https://github.com/python/cpython/issues/59999
+             permissions = zinfo.external_attr >> 16 & 0o777
+-            destination.joinpath(zinfo.filename).chmod(permissions)
++            target_path.chmod(permissions)
+ 
+     print("OK")
+Index: wheel-0.42.0/tests/cli/test_unpack.py
+===================================================================
+--- wheel-0.42.0.orig/tests/cli/test_unpack.py
++++ wheel-0.42.0/tests/cli/test_unpack.py
+@@ -8,6 +8,7 @@ import pytest
+ from wheel.cli.unpack import unpack
+ from wheel.wheelfile import WheelFile
+ 
++from .util import run_command
+ 
+ def test_unpack(wheel_paths, tmp_path):
+     """
+@@ -34,3 +35,26 @@ def test_unpack_executable_bit(tmp_path)
+     unpack(str(wheel_path), str(tmp_path))
+     assert not script_path.is_dir()
+     assert stat.S_IMODE(script_path.stat().st_mode) == 0o755
++
++
++@pytest.mark.skipif(
++    platform.system() == "Windows", reason="Windows does not support chmod()"
++)
++def test_chmod_outside_unpack_tree(tmp_path_factory: TempPathFactory) -> None:
++    wheel_path = tmp_path_factory.mktemp("build") / "test-1.0-py3-none-any.whl"
++    with WheelFile(wheel_path, "w") as wf:
++        wf.writestr(
++            "test-1.0.dist-info/METADATA",
++            "Metadata-Version: 2.4\nName: test\nVersion: 1.0\n",
++        )
++        wf.writestr("../../system-file", b"malicious data")
++
++    extract_root_path = tmp_path_factory.mktemp("extract")
++    system_file = extract_root_path / "system-file"
++    extract_path = extract_root_path / "subdir"
++    system_file.write_bytes(b"important data")
++    system_file.chmod(0o755)
++    run_command("unpack", "--dest", extract_path, wheel_path)
++
++    assert system_file.read_bytes() == b"important data"
++    assert stat.S_IMODE(system_file.stat().st_mode) == 0o755
+Index: wheel-0.42.0/tests/cli/util.py
+===================================================================
+--- /dev/null
++++ wheel-0.42.0/tests/cli/util.py
+@@ -0,0 +1,43 @@
++from __future__ import annotations
++
++import sys
++from io import StringIO
++from os import PathLike
++from subprocess import CalledProcessError
++from unittest.mock import patch
++
++import pytest
++
++from wheel.cli import main
++
++
++def run_command(
++    command: str, *args: str | PathLike, catch_systemexit: bool = True
++) -> str:
++    returncode = 0
++    stdout = StringIO()
++    stderr = StringIO()
++    args = ("wheel", command) + tuple(str(arg) for arg in args)
++    with (
++        patch.object(sys, "argv", args),
++        patch.object(sys, "stdout", stdout),
++        patch.object(sys, "stderr", stderr),
++    ):
++        try:
++            main()
++        except SystemExit as exc:
++            if not catch_systemexit:
++                raise CalledProcessError(
++                    exc.code, args, stdout.getvalue(), stderr.getvalue()
++                ) from exc
++
++            returncode = exc.code
++
++    if returncode:
++        pytest.fail(
++            f"'wheel {command}' exited with return code {returncode}\n"
++            f"arguments: {args}\n"
++            f"error output:\n{stderr.getvalue()}"
++        )
++
++    return stdout.getvalue()
+Index: wheel-0.42.0/tests/cli/__init__.py
+===================================================================
+--- /dev/null
++++ wheel-0.42.0/tests/cli/__init__.py
+@@ -0,0 +1 @@
++

python-wheel.changes

@@ -1,3 +1,39 @@
+-------------------------------------------------------------------
+Wed Jan 28 09:12:46 UTC 2026 - Nico Krapp <nico.krapp@suse.com>
+
+- Add CVE-2026-24049.patch to fix CVE-2026-24049 (bsc#1257100)
+
+-------------------------------------------------------------------
+Thu Mar 27 10:29:43 UTC 2025 - Markéta Machová <mmachova@suse.com>
+
+- Add tests.patch to fix (some) tests with setuptools 77
+- Skip license tests failing with setuptools 77
+
+-------------------------------------------------------------------
+Sat Nov 23 11:03:33 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 0.45.1:
+  * Fixed pure Python wheels converted from eggs and wininst
+    files having the ABI tag in the file name
+
+-------------------------------------------------------------------
+Fri Nov 15 08:22:49 UTC 2024 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Update to 0.45.0
+  * Refactored the ``convert`` command to not need setuptools to be installed
+  * Don't configure setuptools logging unless running ``bdist_wheel``
+  * Added a redirection from ``wheel.bdist_wheel.bdist_wheel`` to
+    ``setuptools.command.bdist_wheel.bdist_wheel`` to improve compatibility with
+    ``setuptools``' latest fixes.
+
+-------------------------------------------------------------------
+Sun Sep  8 13:41:41 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 0.44.0:
+  * Canonicalized requirements in METADATA file
+  * Deprecated the bdist_wheel module, as the code was migrated
+    to setuptools itself
+
 -------------------------------------------------------------------
 Sat Mar 16 14:23:45 UTC 2024 - Dirk Müller <dmueller@suse.com>
 

python-wheel.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-wheel
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -32,13 +32,17 @@
 %endif
 %{?sle15_python_module_pythons}
 Name:           python-wheel%{psuffix}
-Version:        0.43.0
+Version:        0.45.1
 Release:        0
 Summary:        A built-package format for Python
 License:        MIT
 Group:          Development/Languages/Python
 URL:            https://github.com/pypa/wheel
 Source:         https://github.com/pypa/wheel/archive/%{version}.tar.gz#/wheel-%{version}.tar.gz
+# PATCH-FIX-UPSTREAM https://github.com/pypa/wheel/pull/651 fix test failures
+Patch0:          tests.patch
+# PATCH-FIX-UPSTREAM CVE-2026-24049.patch bsc#1257100 gh#pypa/wheel@7a7d2de
+Patch1:         CVE-2026-24049.patch
 # Bootstrap: Don't BuildRequire setuptools or pip here!
 BuildRequires:  %{python_module base >= 3.8}
 BuildRequires:  %{python_module flit-core}
@@ -97,7 +101,8 @@ export PYTHONPATH=build/env/lib/python%{$python_bin_suffix}/site-packages
 %if %{with test}
 export LC_ALL=en_US.utf8
 export PYTHONDONTWRITEBYTECODE=1
-%pytest
+# license tests failing with setuptools 77: https://github.com/pypa/wheel/issues/658
+%pytest -k "not (test_licenses_default or test_licenses_deprecated or test_licenses_override)"
 %endif
 
 %if !%{with test}

tests.patch

@@ -0,0 +1,125 @@
+From 3028d38b5aec19f966660de8e24c45bb5c23f359 Mon Sep 17 00:00:00 2001
+From: shenxianpeng <xianpeng.shen@gmail.com>
+Date: Sun, 16 Mar 2025 01:35:32 +0800
+Subject: [PATCH] Fixed test failures (#651)
+
+---
+ tests/test_bdist_wheel.py            |  4 ++--
+ tests/test_tagopt.py                 | 18 +++++++++---------
+ tests/testdata/unicode.dist/setup.py |  2 +-
+ 3 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
+index fcb2dfc4..21eddd02 100644
+--- a/tests/test_bdist_wheel.py
++++ b/tests/test_bdist_wheel.py
+@@ -79,9 +79,9 @@ def test_no_scripts(wheel_paths):
+ 
+ 
+ def test_unicode_record(wheel_paths):
+-    path = next(path for path in wheel_paths if "unicode.dist" in path)
++    path = next(path for path in wheel_paths if "unicode_dist" in path)
+     with ZipFile(path) as zf:
+-        record = zf.read("unicode.dist-0.1.dist-info/RECORD")
++        record = zf.read("unicode_dist-0.1.dist-info/RECORD")
+ 
+     assert "åäö_日本語.py".encode() in record
+ 
+diff --git a/tests/test_tagopt.py b/tests/test_tagopt.py
+index 5335af44..5733e1a9 100644
+--- a/tests/test_tagopt.py
++++ b/tests/test_tagopt.py
+@@ -14,7 +14,7 @@
+ from setuptools import setup, Extension
+ 
+ setup(
+-    name="Test",
++    name="test",
+     version="1.0",
+     author_email="author@example.com",
+     py_modules=["test"],
+@@ -63,7 +63,7 @@ def test_default_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name == f"Test-1.0-py{sys.version_info[0]}-none-any.whl"
++    assert wheels[0].name == f"test-1.0-py{sys.version_info[0]}-none-any.whl"
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -76,7 +76,7 @@ def test_build_number(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name == f"Test-1.0-1-py{sys.version_info[0]}-none-any.whl"
++    assert wheels[0].name == f"test-1.0-1-py{sys.version_info[0]}-none-any.whl"
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -89,7 +89,7 @@ def test_explicit_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py32-")
++    assert wheels[0].name.startswith("test-1.0-py32-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -101,7 +101,7 @@ def test_universal_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -114,7 +114,7 @@ def test_universal_beats_explicit_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -129,7 +129,7 @@ def test_universal_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -144,7 +144,7 @@ def test_pythontag_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py32-")
++    assert wheels[0].name.startswith("test-1.0-py32-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -157,7 +157,7 @@ def test_legacy_wheel_section_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+diff --git a/tests/testdata/unicode.dist/setup.py b/tests/testdata/unicode.dist/setup.py
+index ec66d1e6..46ef0a10 100644
+--- a/tests/testdata/unicode.dist/setup.py
++++ b/tests/testdata/unicode.dist/setup.py
+@@ -3,7 +3,7 @@
+ from setuptools import setup
+ 
+ setup(
+-    name="unicode.dist",
++    name="unicode_dist",
+     version="0.1",
+     description="A testing distribution \N{SNOWMAN}",
+     packages=["unicodedist"],