backport-CVE-2022-40897.patch

@@ -1,43 +0,0 @@
-From 43a9c9bfa6aa626ec2a22540bea28d2ca77964be Mon Sep 17 00:00:00 2001
-From: "Jason R. Coombs" <jaraco@jaraco.com>
-Date: Fri, 4 Nov 2022 13:47:53 -0400
-Subject: [PATCH] Limit the amount of whitespace to search/backtrack.Fixes
- #3659.
-
----
- setuptools/package_index.py           | 2 +-
- setuptools/tests/test_packageindex.py | 8 ++++++++
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/setuptools/package_index.py b/setuptools/package_index.py
-index 270e7f3..e93fcc6 100644
---- a/setuptools/package_index.py
-+++ b/setuptools/package_index.py
-@@ -197,7 +197,7 @@ def unique_values(func):
-     return wrapper
- 
- 
--REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
-+REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
- # this line is here to fix emacs' cruddy broken syntax highlighting
- 
- 
-diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
-index 8e9435e..fc544c0 100644
---- a/setuptools/tests/test_packageindex.py
-+++ b/setuptools/tests/test_packageindex.py
-@@ -308,3 +308,11 @@ class TestPyPIConfig:
-         cred = cfg.creds_by_repository['https://pypi.org']
-         assert cred.username == 'jaraco'
-         assert cred.password == 'pity%'
-+
-+
-+@pytest.mark.timeout(1)
-+def test_REL_DoS():
-+    """
-+    REL should not hang on a contrived attack string.
-+    """
-+    setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)
--- 
-2.27.0
-

python-setuptools.spec

@@ -1,4 +1,3 @@
-%bcond_with bootstrap
 %bcond_with tests
 
 %global python3_record %{python3_sitelib}/setuptools-%{version}.dist-info/RECORD
@@ -8,15 +7,12 @@
 
 Name: python-setuptools
 Version: 59.4.0
-Release: 5
+Release: 1
 Summary: Easily build and distribute Python packages
 
 License: MIT and (BSD or ASL 2.0)
 URL: https://pypi.python.org/pypi/setuptools
 Source0: %{pypi_source setuptools %{version}}
-
-Patch6000: backport-CVE-2022-40897.patch
-
 Patch9000: bugfix-eliminate-random-order-in-metadata.patch
 
 BuildArch: noarch
@@ -27,9 +23,7 @@ BuildRequires: python3-pip, python3-mock
 BuildRequires: python3-pytest, python3-pytest-fixture-config
 BuildRequires: python3-pytest-virtualenv
 %endif
-%if %{without bootstrap}
 BuildRequires: python3-pip, python3-wheel
-%endif
 
 Provides: python-distribute = %{version}-%{release}, %{name}-wheel
 Obsoletes: python-distribute < 0.6.36-2, %{name}-wheel
@@ -43,8 +37,6 @@ This package contains a python wheel of setuptools to use with venv.
 
 %package -n python3-setuptools
 Summary: Easily build and distribute Python 3 packages
-Provides:  python%{python3_pkgversion}dist(setuptools) = %{version}
-Provides:  python%{python3_version}dist(setuptools) = %{version}
 Conflicts: python-setuptools < %{version}-%{release}
 
 %description -n python3-setuptools
@@ -66,14 +58,9 @@ rm setuptools/tests/test_integration.py
 chmod -x README.rst
 
 %build
-%if %{without bootstrap}
 %py3_build_wheel
-%else
-%py3_build
-%endif
 
 %install
-%if %{without bootstrap}
 %py3_install_wheel %{python_whlname}
 sed -i '/\/usr\/bin\/easy_install,/d' %{buildroot}%{python3_record}
 rm -rf %{buildroot}%{python3_sitelib}/{setuptools, pkg_resources}/tests
@@ -83,9 +70,6 @@ find %{buildroot}%{python3_sitelib} -name '*.exe' | xargs rm -f
 rm -r docs/{conf.py,_*}
 mkdir -p %{buildroot}%{python_whldir}
 install -p dist/%{python_whlname} -t %{buildroot}%{python_whldir}
-%else
-%py3_install
-%endif
 
 %if %{with tests}
 %check
@@ -95,10 +79,8 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=
 %files
 %defattr(-,root,root)
 %license LICENSE
-%if %{without bootstrap}
 %dir %{python_whldir}/
 %{python_whldir}/%{python_whlname}
-%endif
 
 %files -n python3-setuptools
 %defattr(-,root,root)
@@ -113,21 +95,6 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=
 
 
 %changelog
-* Wed Jan 04 2023 zhuofeng <zhuofeng2@huawei.com> - 59.4.0-5                                     
-- Type:CVE
-- CVE:CVE-2022-40897
-- SUG:NA
-- DESC:fix CVE-2022-40897
-
-* Thu Oct 27 2022 zhangruifang <zhangruifang1@h-partners.com> - 59.4.0-4
-- Rebuild for next release
-
-* Tue Jan 04 2022 shixuantong <shixuantong@huawei.com> - 59.4.0-3
-- Bootstrap for Python 3.9.9
-
-* Wed Dec 29 2021 shixuantong <shixuantong@huawei.com> - 59.4.0-2
-- add bootstrap for rebuild python3-3.9.9
-
 * Wed Dec 22 2021 renhongxun<renhongxun@huawei.com> - 59.4.0-1
 - upgrade version to 59.4.0