Add CVE-2025-68146.patch to fix CVE-2025-68146 (bsc#1255244)

OBS-URL: https://build.opensuse.org/request/show/1254336
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-filelock?expand=0&rev=24

CVE-2025-68146.patch

@@ -0,0 +1,14 @@
+Index: filelock-3.18.0/src/filelock/_unix.py
+===================================================================
+--- filelock-3.18.0.orig/src/filelock/_unix.py
++++ filelock-3.18.0/src/filelock/_unix.py
+@@ -39,6 +39,9 @@ else:  # pragma: win32 no cover
+         def _acquire(self) -> None:
+             ensure_directory_exists(self.lock_file)
+             open_flags = os.O_RDWR | os.O_TRUNC
++            o_nofollow = getattr(os, "O_NOFOLLOW", None)
++            if o_nofollow is not None:
++                open_flags |= o_nofollow
+             if not Path(self.lock_file).exists():
+                 open_flags |= os.O_CREAT
+             fd = os.open(self.lock_file, open_flags, self._context.mode)

_multibuild

@@ -0,0 +1,3 @@
+<multibuild>
+  <package>test</package>
+</multibuild>

filelock-3.15.1.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:58a2549afdf9e02e10720eaa4d4470f56386d7a6f72edd7d0596337af8ed7ad8
-size 17564

python-filelock.changes

@@ -1,3 +1,44 @@
+-------------------------------------------------------------------
+Wed Jan  7 09:12:08 UTC 2026 - Nico Krapp <nico.krapp@suse.com>
+
+- Add CVE-2025-68146.patch to fix CVE-2025-68146 (bsc#1255244)
+
+-------------------------------------------------------------------
+Wed Mar 19 07:44:21 UTC 2025 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Update to 3.18.0
+  * Indicate that locks are exclusive/write locks
+  * Support fcntl check on Emscripten
+
+-------------------------------------------------------------------
+Thu Jan 30 11:22:48 UTC 2025 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Update to 3.17.0
+  * Drop support for Python 3.8
+  * Update README.md
+
+-------------------------------------------------------------------
+Wed Oct  9 07:27:30 UTC 2024 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Update to 3.16.1
+  * CI improvements
+
+-------------------------------------------------------------------
+Sun Sep  8 15:56:37 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 3.16.0:
+  * Test Python 3.13
+  * Add 3.13 to CI
+- update to 3.15.4:
+  * Pass `file_lock` as positional argument
+- update to 3.15.3:
+  * Add test for virtualenv stability
+  * Fix `TypeError: _CountedFileLock.__init__() got an unexpected
+    keyword argument 'timeout'`
+- update to 3.15.2:
+  * Use a metaclass to implement the singleton pattern
+- split into test multibuild to avoid cycle over virtualenv
+
 -------------------------------------------------------------------
 Mon Jun 17 06:00:15 UTC 2024 - Dirk Müller <dmueller@suse.com>
 

python-filelock.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-filelock
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 # Copyright (c) 2018 Matthias Fehring <buschmann23@opensuse.org>
 #
 # All modifications and additions to the file contributed by third parties
@@ -17,22 +17,35 @@
 #
 
 
+%global flavor @BUILD_FLAVOR@%{nil}
+%if "%{flavor}" == "test"
+%define pkg_suffix -test
+%bcond_without test
+%else
+%define pkg_suffix %{nil}
+%bcond_with test
+%endif
 %{?sle15_python_module_pythons}
-Name:           python-filelock
+Name:           python-filelock%{?pkg_suffix}
-Version:        3.15.1
+Version:        3.18.0
 Release:        0
 Summary:        Platform Independent File Lock in Python
 License:        Unlicense
 URL:            https://github.com/tox-dev/py-filelock
 Source:         https://files.pythonhosted.org/packages/source/f/filelock/filelock-%{version}.tar.gz
+# PATCH-FIX-UPSTREAM CVE-2025-68146.patch bsc#1255244 (gh#tox-dev/filelock/pulls/461, gh#tox-dev/filelock/pulls/463)
+Patch0:         CVE-2025-68146.patch
 BuildRequires:  %{python_module asyncio}
 BuildRequires:  %{python_module hatch_vcs}
 BuildRequires:  %{python_module hatchling}
 BuildRequires:  %{python_module pip}
+BuildRequires:  %{python_module wheel}
+%if %{with test}
 BuildRequires:  %{python_module pytest-asyncio}
 BuildRequires:  %{python_module pytest-mock}
 BuildRequires:  %{python_module pytest}
-BuildRequires:  %{python_module wheel}
+BuildRequires:  %{python_module virtualenv}
+%endif
 BuildRequires:  fdupes
 BuildRequires:  python-rpm-macros
 %if 0%{?python_version_nodots} < 311
@@ -48,22 +61,25 @@ independent file lock in Python, which provides a simple way of
 inter-process communication.
 
 %prep
-%setup -q -n filelock-%{version}
+%autosetup -p1 -n filelock-%{version}
 
 %build
 %pyproject_wheel
 
+%if !%{with test}
 %install
 %pyproject_install
 %python_expand %fdupes %{buildroot}/%{$python_sitelib}
 
-%check
-%pytest -rs
-
 %files %{python_files}
 %doc README.md
 %license LICENSE
 %{python_sitelib}/filelock
 %{python_sitelib}/filelock-%{version}*-info
+%else
+
+%check
+%pytest -rs
+%endif
 
 %changelog