projects / gentoo.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: e102fe3)
updating for CVE-2015-1852
authorMatt Thode <prometheanfire@gentoo.org>
Tue, 14 Apr 2015 16:11:50 +0000 (16:11 +0000)
committerMatt Thode <prometheanfire@gentoo.org>
Tue, 14 Apr 2015 16:11:50 +0000 (16:11 +0000)
Package-Manager: portage-2.2.14/cvs/Linux x86_64
Manifest-Sign-Key: 0x33ED3FD25AFC78BA

dev-python/keystonemiddleware/ChangeLog patch | blob | history
dev-python/keystonemiddleware/Manifest patch | blob | history
dev-python/keystonemiddleware/files/cve-2015-1852-master-keystonemiddleware.patch [new file with mode: 0644] patch | blob
dev-python/keystonemiddleware/keystonemiddleware-1.5.0.ebuild [moved from dev-python/keystonemiddleware/keystonemiddleware-1.1.1.ebuild with 57% similarity] patch | blob | history

diff --git a/dev-python/keystonemiddleware/ChangeLog b/dev-python/keystonemiddleware/ChangeLog
index 810e1b1c41c492d06812f7adce5dc9fc33a27419..aecae6c115ebc093daaa3ff6882bcdcbd1052846 100644 (file)
--- a/dev-python/keystonemiddleware/ChangeLog
+++ b/dev-python/keystonemiddleware/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for dev-python/keystonemiddleware
-# Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-python/keystonemiddleware/ChangeLog,v 1.1 2014/09/22 21:29:58 prometheanfire Exp $
+# Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/dev-python/keystonemiddleware/ChangeLog,v 1.2 2015/04/14 16:11:45 prometheanfire Exp $
+
+*keystonemiddleware-1.5.0 (14 Apr 2015)
+
+  14 Apr 2015; Matthew Thode <prometheanfire@gentoo.org>
+  +files/cve-2015-1852-master-keystonemiddleware.patch,
+  +keystonemiddleware-1.5.0.ebuild, -keystonemiddleware-1.1.1.ebuild:
+  updating for CVE-2015-1852
 
 *keystonemiddleware-1.1.1 (22 Sep 2014)
 
diff --git a/dev-python/keystonemiddleware/Manifest b/dev-python/keystonemiddleware/Manifest
index 6752a37df7d9b13136519e69ab16fd71c0510282..c790839c708fa5d5690da874eb4aa3d880165ddc 100644 (file)
--- a/dev-python/keystonemiddleware/Manifest
+++ b/dev-python/keystonemiddleware/Manifest
@@ -1,24 +1,25 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
-DIST keystonemiddleware-1.1.1.tar.gz 114215 SHA256 29e2823138219b29a86450293cac64f7554bf6c5cab79f091068137887bc8b70 SHA512 517d59c413785904814b1315ffd0894df54ebe7668ead42d69dfe89da680277ffdf822f6a0300060f90f238c4d2a98624462239de3c74bbce639a4fdc0136e8a WHIRLPOOL 8cea6d2b87b0b7caa8db05299aab91b7e4949bcd1a5c6f1a431473d31149962e8ea1a90f3c3bc1a5ce9c16ff2ce94823d353f7d0bb68dd3a30b9785bade30801
-EBUILD keystonemiddleware-1.1.1.ebuild 2306 SHA256 36ea6e66dd70e1fdd3dbe2296d8e5b0afee6a84d017d113630013120cf848c62 SHA512 2c962df39f6818709c662a67109adcfe4542b6db8a3d6f3deec0ac70e06df3ea06ba0ac51930cc702dce361620b9111ae390bbf572684d857ac4c526d5b37c0d WHIRLPOOL 5630219ce95116850e41dc35a25c79e5cf5552ba2672abab01b353e65e1f6df94c8189326851d93bb9317947c0c9f792e8a8f42c6f756eddda7e6cc3f7246e6d
-MISC ChangeLog 406 SHA256 2df00dd1d97522968f52e249e720dbd4334c333669ae8f8a524c3a893882dc74 SHA512 a2e694d75a7c332bd3575cef56df85744666395dabde6548726c6c810d440f0050751f9c2d20757a1b78083767710affb9f982849e90339a106008f0b82f4d17 WHIRLPOOL 4a633f760ae0f63be0de98fced107efb06ec2cea4be8017cfea3af6b8bf9a9211298cd37ec6d90906e887eac0c060b5a081a6782ad6cfd56120a307c63e5eeb3
+AUX cve-2015-1852-master-keystonemiddleware.patch 2606 SHA256 3f1fe254a8be40bfbf3441dc1db69d409b300cf3e7aa7fa143a81527cd37d1ca SHA512 90bf9bb62cc874fe7c34f67dc1069858c9a8da7ab32506b296e78a61d88597d21ae9c4e1334c0b91e31a6bc02c85170030b9c604e46ba30e7043998342dc920b WHIRLPOOL 04c941466ef6d209ef34195bd2f05ecb9716bd5801a59cea87a4e5f53ffc9ca15deed0fa4dc58f7e15dce6d6a98f2cb0455b2f51a06753bd338030a93e0beaed
+DIST keystonemiddleware-1.5.0.tar.gz 176315 SHA256 73e98aab8bceb7843b6cc8aba2cbff824a379428519e2f9ffbb8e32578b38fe8 SHA512 365643f7eba633587d8055204df04cfb40bdcc28c57d7ecf8c4ed67803b9b027b6334f868a1bc634d9beefd7410d74da08a7ed599637ec1656e6ef6196043dab WHIRLPOOL da7014869d3fc1ac5339671344542e33c22ac07adfb76ad00144cdcf4e1e26c60eea7ca7867cea6c6e105af1d05be64eff7d55ae1b3cf5114597da966b756b55
+EBUILD keystonemiddleware-1.5.0.ebuild 2696 SHA256 4e06d7e3286d34c37c1b00ea399fb78fee97ca795bb998127149ed80d80a448c SHA512 591b06b2cb54327365b258de7c465b3ec7dd3843a27519656af045ff168917b1a045a770728861b7080a2e69b6faa389d5cc2e9ef8ad840e582700d4884ec121 WHIRLPOOL 3dc6e256dcfe85cae1d6342e58988c298b94a18bffc2dd8022969704576cc0edf9f27a45691fecbcc0e86c56f1bf6f9b75455aa8c2110942d79e68f941c440a4
+MISC ChangeLog 660 SHA256 4a162abc574af48c67a675aa2d6e668d6533b3c3fb1da986e6ab02e1af2d5134 SHA512 7cf816882285301e100dbeafbaa043558bcff4be80278fc0f5da6ded3286206c552ab8dc3101a6116631ca2c2f7b6fc964c8efcad029d31436700d99dca8d9d6 WHIRLPOOL 79d8d26dbc0aead69c4c8cbd87db756ce53b276cf0f247b3970323e3856aaaac7c8efc0701cdc09636227acfd4653412b03b5bfbab26ba237451e2900ab14d61
 MISC metadata.xml 368 SHA256 2977a1caa70d2a7b2687f84c15f2db09e8feb739b3dc46d8a1c9143e5e550a1e SHA512 18c1f98d2e52e14aa4fdbd8842c40c6e3555d51dd5cb6cd4d88a6e13017f87fd8fd8f57729fc9deec819d6a4d04f864714844f23cadb5befa6000d1cd144921f WHIRLPOOL 9c8369f8f3448863124702ba3a3e9968f1bf5d763485730bb8a92006dba8e3023488486244bb6e0c5486c8039c3504598c97393433cc884d374bd9675a6fe50e
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
-iQIcBAEBCAAGBQJUIJT3AAoJECRx6z5ArFrDV+YP/0pUncsZgPDr9rLvkPZBXzsq
-yS9U4iC07g5kRrupkQIz+yjQilsbUf+o/FLygPVicN27++/RU7RnXPJgRvNDJ09V
-mR/lgo+dgNTvluOFE4iBFF19B+BMHwNsdPT0rMfeBL8KlyxXaE5aoDaBIvNRzPew
-nS4HHXD6KBf1wNmPlftLXszaYOL5m9F58JdE2EwaYR2HY63zsb9kDH/lgygFk0r1
-MVhDjpIqx/Q3uOG3n2z+mGgOzmkTjvxfcJNGF0M1HkFEl9gaBlZK/C0Y1G5f6Wcw
-v3kF0ReEApl2PW8HdVOdpB5k8YCE/fwb6Z2Eni8XGrWw1GNwsvkqE9oWbH0Euyyk
-c5RwHwsQZ5aoK1wMEHZjjjw20dI4AhT6BoDLykXLEkVhkv8QbB1BK7uFt39TbQXP
-17+gxjrovs51YpQWWZtpJ1MVk96ylVy1jj6PSpTH6mfB5Q+XgLGvbzZbuYr4O+wI
-Q8654Oq0EiPZwYD9mCQIvs4WrfJyE5dqn2PnNKVIE/Bche3Bl4J2FV0/0WBVRvwv
-94oOr7knfXnUFHEjWjWc//85K3ca7C/gEsAblBdvEeG76zurqh2hJ0L8OUOdnI29
-dT1rVYKUStoBzlTRgb8i62ANw9kY2YPTsGhfjFx3Bo+mL9p6YzYtJtmLcTW4KufL
-RAD/dNBnHYYLZkFYn9i7
-=p0z9
+iQIcBAEBCAAGBQJVLTxMAAoJEGSje+quGaTo0+kP/RGklNzzRqzK1rUmxAKdo055
+5ICErbAsrkm3zrI/eHNjcAyJs73agnIlo7GkL/tAtlOuQcG8L6A7s4ZC6wO+M5Iv
+TMJSuRF8TYo2gxi+s6MhXe1E4Wy7qVpqWsRNhpn7yGGmQQ/nl1xu4UkH6U5zKQAu
+vbhvFNU2+R+9KmxiMOnjvNaXW+OzameeuqKMjPBveECZDtqKp3iAIb2RqwmL44e3
+MeEMlTwEuXH4QVLAUtmrUWAMpV27xUCyEpKnXb+cYq6MGoMlUit1ZNNxXdnaBHMX
+8LNzRv9OOvTTPkcEs0x8s6Iak6yGgDRy89SR3RH5N5D2ewNWEEnSAD2/9/l6V/HA
+zoKguszjIVZFG++Y4JCKIOdxyrU/eB1K0jynvrq0WXQ9QdGQHk6RTd5D2S3Jz1P9
+OxJtdiCpmK8cUh04o1HDv3SQi/uNtnok7NZ96O1XyRT416/+ziBpKQg1qqC6bzsH
+8y5o2VP1QYazCure4qs6iaaNZwc1agcMd3Nk1XbkEL9fe4rmvSpfjOL+CUnxi//c
+i3f6dVc+JuJGlX1haNgszENjZvhzywsEzPnz9lApjVZ/TpkR1oq2lBrEuO/ntjmy
+L21d1sDBW41NgbLHUPa4RG1reLLo82ZUzWSAVHB2RK8ue3kfW+mb78TP6nZKrplA
+S79L6GYE8lmd/UWa5X9e
+=0pjL
 -----END PGP SIGNATURE-----
diff --git a/dev-python/keystonemiddleware/files/cve-2015-1852-master-keystonemiddleware.patch b/dev-python/keystonemiddleware/files/cve-2015-1852-master-keystonemiddleware.patch
new file mode 100644 (file)
index 0000000..6ea8f99
--- /dev/null
+++ b/dev-python/keystonemiddleware/files/cve-2015-1852-master-keystonemiddleware.patch
@@ -0,0 +1,63 @@
+diff --git a/keystonemiddleware/s3_token.py b/keystonemiddleware/s3_token.py
+index d56482f..3fe13f9 100644
+--- a/keystonemiddleware/s3_token.py
++++ b/keystonemiddleware/s3_token.py
+@@ -35,6 +35,7 @@ import logging
+ import webob
+ 
+ from oslo_serialization import jsonutils
++from oslo_utils import strutils
+ import requests
+ import six
+ from six.moves import urllib
+@@ -116,7 +117,7 @@ class S3Token(object):
+                                             auth_port)
+ 
+         # SSL
+-        insecure = conf.get('insecure', False)
++        insecure = strutils.bool_from_string(conf.get('insecure', False))
+         cert_file = conf.get('certfile')
+         key_file = conf.get('keyfile')
+ 
+diff --git a/keystonemiddleware/tests/test_s3_token_middleware.py b/keystonemiddleware/tests/test_s3_token_middleware.py
+index fdadb76..4b910a6 100644
+--- a/keystonemiddleware/tests/test_s3_token_middleware.py
++++ b/keystonemiddleware/tests/test_s3_token_middleware.py
+@@ -124,7 +124,7 @@ class S3TokenMiddlewareTestGood(S3TokenMiddlewareTestBase):
+     @mock.patch.object(requests, 'post')
+     def test_insecure(self, MOCK_REQUEST):
+         self.middleware = (
+-            s3_token.filter_factory({'insecure': True})(FakeApp()))
++            s3_token.filter_factory({'insecure': 'True'})(FakeApp()))
+ 
+         text_return_value = jsonutils.dumps(GOOD_RESPONSE)
+         if six.PY3:
+@@ -142,6 +142,28 @@ class S3TokenMiddlewareTestGood(S3TokenMiddlewareTestBase):
+         mock_args, mock_kwargs = MOCK_REQUEST.call_args
+         self.assertIs(mock_kwargs['verify'], False)
+ 
++    def test_insecure_option(self):
++        # insecure is passed as a string.
++
++        # Some non-secure values.
++        true_values = ['true', 'True', '1', 'yes']
++        for val in true_values:
++            config = {'insecure': val, 'certfile': 'false_ind'}
++            middleware = s3_token.filter_factory(config)(FakeApp())
++            self.assertIs(False, middleware._verify)
++
++        # Some "secure" values, including unexpected value.
++        false_values = ['false', 'False', '0', 'no', 'someweirdvalue']
++        for val in false_values:
++            config = {'insecure': val, 'certfile': 'false_ind'}
++            middleware = s3_token.filter_factory(config)(FakeApp())
++            self.assertEqual('false_ind', middleware._verify)
++
++        # Default is secure.
++        config = {'certfile': 'false_ind'}
++        middleware = s3_token.filter_factory(config)(FakeApp())
++        self.assertIs('false_ind', middleware._verify)
++
+ 
+ class S3TokenMiddlewareTestBad(S3TokenMiddlewareTestBase):
+     def setUp(self):
diff --git a/dev-python/keystonemiddleware/keystonemiddleware-1.1.1.ebuild b/dev-python/keystonemiddleware/keystonemiddleware-1.5.0.ebuild
similarity index 57%
rename from dev-python/keystonemiddleware/keystonemiddleware-1.1.1.ebuild
rename to dev-python/keystonemiddleware/keystonemiddleware-1.5.0.ebuild
index 739d39eef63559a2884fb14594042edb98d45ec0..90bee3374b2d6c80f23f3166fd071161e9566332 100644 (file)
--- a/dev-python/keystonemiddleware/keystonemiddleware-1.1.1.ebuild
+++ b/dev-python/keystonemiddleware/keystonemiddleware-1.5.0.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-python/keystonemiddleware/keystonemiddleware-1.1.1.ebuild,v 1.1 2014/09/22 21:29:58 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-python/keystonemiddleware/keystonemiddleware-1.5.0.ebuild,v 1.1 2015/04/14 16:11:45 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -17,38 +17,45 @@ KEYWORDS="~amd64 ~x86 ~amd64-linux ~x86-linux"
 IUSE="doc examples test"
 
 DEPEND="dev-python/setuptools[${PYTHON_USEDEP}]
-               >=dev-python/pbr-0.6[${PYTHON_USEDEP}]
-               !~dev-python/pbr-0.7[${PYTHON_USEDEP}]
+               >=dev-python/pbr-0.8[${PYTHON_USEDEP}]
                <dev-python/pbr-1.0[${PYTHON_USEDEP}]
                test? (
+                       >=dev-python/hacking-0.10[${PYTHON_USEDEP}]
+                       <dev-python/hacking-0.11[${PYTHON_USEDEP}]
                        >=dev-python/coverage-3.6[${PYTHON_USEDEP}]
                        >=dev-python/fixtures-0.3.14[${PYTHON_USEDEP}]
-                       >=dev-python/hacking-0.8[${PYTHON_USEDEP}]
-                       <dev-python/hacking-0.9[${PYTHON_USEDEP}]
-                       >=dev-python/httpretty-0.8.0[${PYTHON_USEDEP}]
-                       !~dev-python/httpretty-0.8.1[${PYTHON_USEDEP}]
-                       !~dev-python/httpretty-0.8.2[${PYTHON_USEDEP}]
-                       >=dev-python/keyring-2.1[${PYTHON_USEDEP}]
                        >=dev-python/mock-1.0[${PYTHON_USEDEP}]
                        >=dev-python/pycrypto-2.6[${PYTHON_USEDEP}]
-                       dev-python/oslo-sphinx[${PYTHON_USEDEP}]
+                       >=dev-python/oslo-sphinx-2.2.0[${PYTHON_USEDEP}]
+                       dev-python/oslotest[${PYTHON_USEDEP}]
+                       dev-python/oslo-messaging[${PYTHON_USEDEP}]
+                       dev-python/requests-mock[${PYTHON_USEDEP}]
                        >=dev-python/sphinx-1.1.2[${PYTHON_USEDEP}]
                        !~dev-python/sphinx-1.2.0[${PYTHON_USEDEP}]
                        <dev-python/sphinx-1.3[${PYTHON_USEDEP}]
                        >=dev-python/testrepository-0.0.18[${PYTHON_USEDEP}]
                        >=dev-python/testresources-0.2.4[${PYTHON_USEDEP}]
-                       >=dev-python/testtools-0.9.34[${PYTHON_USEDEP}]
+                       >=dev-python/testtools-0.9.36[${PYTHON_USEDEP}]
+                       !~dev-python/testtools-1.2.0[${PYTHON_USEDEP}]
+                       >=dev-python/python-memcached-1.48[${PYTHON_USEDEP}]
                )"
 
 RDEPEND=">=dev-python/Babel-1.3[${PYTHON_USEDEP}]
                >=dev-python/iso8601-0.1.9[${PYTHON_USEDEP}]
-               >=dev-python/netaddr-0.7.6[${PYTHON_USEDEP}]
-               >=dev-python/oslo-config-1.4.0[${PYTHON_USEDEP}]
-               >=dev-python/requests-1.2.1[${PYTHON_USEDEP}]
-               >=dev-python/six-1.7.0[${PYTHON_USEDEP}]
+               >=dev-python/oslo-config-1.9.0[${PYTHON_USEDEP}]
+               >=dev-python/oslo-context-0.2.0[${PYTHON_USEDEP}]
+               >=dev-python/oslo-i18n-1.3.0[${PYTHON_USEDEP}]
+               >=dev-python/oslo-serialization-1.2.0[${PYTHON_USEDEP}]
+               >=dev-python/oslo-utils-1.2.0[${PYTHON_USEDEP}]
+               >=dev-python/pycadf-0.8.0[${PYTHON_USEDEP}]
+               >=dev-python/python-keystoneclient-1.1.0[${PYTHON_USEDEP}]
+               >=dev-python/requests-2.2.0[${PYTHON_USEDEP}]
+               !~dev-python/requests-2.4.0[${PYTHON_USEDEP}]
+               >=dev-python/six-1.9.0[${PYTHON_USEDEP}]
                >=dev-python/webob-1.2.3[${PYTHON_USEDEP}]"
 
 PATCHES=(
+"${FILESDIR}/cve-2015-1852-master-keystonemiddleware.patch"
 )
 
 python_compile_all() {
Unnamed repository; edit this file 'description' to name the repository.