From c012d247f03a893c117c88f73bcf6cb6494dcd22 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Sep 2026 03:04:39 -0500 Subject: Adding metadata --- dev-python/tornado/Manifest | 4 +- .../files/tornado-6.5.7-pycurl-7.47.0.patch | 82 ---------------------- dev-python/tornado/tornado-6.5.7.ebuild | 63 ----------------- dev-python/tornado/tornado-6.5.9.ebuild | 61 ++++++++++++++++ 4 files changed, 63 insertions(+), 147 deletions(-) delete mode 100644 dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch delete mode 100644 dev-python/tornado/tornado-6.5.7.ebuild create mode 100644 dev-python/tornado/tornado-6.5.9.ebuild (limited to 'dev-python/tornado') diff --git a/dev-python/tornado/Manifest b/dev-python/tornado/Manifest index ae3555d3588a..7fcffa153f4c 100644 --- a/dev-python/tornado/Manifest +++ b/dev-python/tornado/Manifest @@ -1,4 +1,4 @@ -DIST tornado-6.5.7.tar.gz 519252 BLAKE2B 7d2a2f265de1137c632bf222dc8e8e65efe9328c7c82af5741e069be1dae34de33547a93844518c213ca131d064d87db1d438145e47cfc0da4ddb4485bad9a33 SHA512 bd9790da5dc84580710cc74cda0f8f691ff0af845e9e4b47c431333aae5107d808f8a3a82155d4cddefb86f4c516f3a2bef15edcb19d743b936d20d101db7cf1 -DIST tornado-6.5.7.tar.gz.provenance 9369 BLAKE2B 4893e0653f2c39d9aa89a2a7c888860aad829f255394308f11de1a2ece80a00cf479270427cf833720e524d91b42926645f63f2867a4a441b6273b7e4722a076 SHA512 3e97725d8964764cab43f4750d88843394a0577d54e6529e13de5ab55e5898f4853e59bbe973c813e7c05c67e4c9f472e3569f6e934559b9a9bcb71cd38dbcc6 DIST tornado-6.5.8.tar.gz 520493 BLAKE2B e48ca20fe0551b8536162071e0b9267ccd167df617c25f930481668e733c656904109014e65462e561d47acc557cfe32f86a422e8f7e840b4262acbafb2b720a SHA512 88c096ca30357644c07b6013cd514b5e64135b26a77d9ff17640951632d6f68c9a68d7fa80224743f7900fbf5ddde838088bd9838395651d87d876c8d1d1a2fe DIST tornado-6.5.8.tar.gz.provenance 9416 BLAKE2B 1f4d1d9289f8aa8fdde1dda19454da15e9056111f0225e0701eb385ef42b0fae26a6bb9dc5df3ffb9796e4d805db5aa7406aa466ec9389802df1033cdb5231a6 SHA512 b1c364aed55ecb3cbab7343de9ebfaa181579ca81a57e498953c7d0e657bd8b08ee9fb6e5f72d8205f379fbd25237054bfecdb9982fc973e4bb55a00a0411444 +DIST tornado-6.5.9.tar.gz 536145 BLAKE2B 13071c50a8f0701d750f26aa5fb3669ee5c78c4d249d570b519a672d8fdfa76d38f90633ad21fa1c7d551c50c5f6d0dab53ebb694685d52f1cc1269cb0728564 SHA512 e497f0cacca0ca0d34b65117a72e9ebe0056f77ced09eb5d200dea24da8c28182d5704d1b17510fc139841718fce6a19c7f154d416e59292f4236eb717a0a75c +DIST tornado-6.5.9.tar.gz.provenance 9473 BLAKE2B 9c58b5c0753dee0f9e111cd5007512fffc91964cad3eeed7e11758aff96f239692492f35f220f08ef10bfd249013d3d1c550a4f79a3669c86abd5ef5fd2922a7 SHA512 20cb384accabf2c8659f90446c2f39d3b3535662114e0707521a870e291879da15a8c6c0fac61a6e64a26e4f64ccfc8d8f1dd3db60717b3121a52263422fb061 diff --git a/dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch b/dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch deleted file mode 100644 index 4bc9ebd46c69..000000000000 --- a/dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 9648c5892c232fd7b02b9ad80d2bbe09ac38edb3 Mon Sep 17 00:00:00 2001 -From: Claude -Date: Sat, 4 Jul 2026 19:10:59 +0000 -Subject: [PATCH] Fix test_strip_headers_on_redirect's URL-embedded-credentials - cases - -url.replace("http://", ...) replaced every occurrence of "http://" in -the fetched URL, including the one inside the "url" query parameter -that RedirectHandler uses as the redirect target. That accidentally -embedded the test credentials in the Location header's URL too, so -the "different origin" subtest was actually exercising "does libcurl -honor credentials the server explicitly put in the redirect target" -rather than "does libcurl strip credentials carried over from the -original request" - libcurl correctly does the former, which is not -a credential leak. - -Limit the replacement to the first occurrence so only the outer, -fetched URL carries the test credentials. - -Separately, the "same origin" subtest for this case now surfaces an -actual libcurl regression (still present in curl's git master as of -this writing): credentials embedded in the URL are dropped across a -same-origin redirect when the Location header is an absolute URL -(a relative Location correctly preserves them). This isn't a security -issue since nothing leaks to another origin, so that specific -assertion is skipped rather than asserted either way. ---- - tornado/test/httpclient_test.py | 29 ++++++++++++++++++++++------- - 1 file changed, 22 insertions(+), 7 deletions(-) - -diff --git a/tornado/test/httpclient_test.py b/tornado/test/httpclient_test.py -index 64e5cc5ff..1540ac3c2 100644 ---- a/tornado/test/httpclient_test.py -+++ b/tornado/test/httpclient_test.py -@@ -785,7 +785,12 @@ def test_strip_headers_on_redirect(self): - "/redirect?url=%s&status=302" % self.get_url2("/echo_headers") - ) - if url_creds: -- url = url.replace("http://", "http://%s@" % url_creds) -+ # Only add credentials to the outer URL being fetched, not to the -+ # "url" query parameter (the redirect target), which also starts -+ # with "http://". Otherwise the redirect's Location header would -+ # carry its own explicit credentials for the new origin, which -+ # libcurl legitimately honors instead of stripping. -+ url = url.replace("http://", "http://%s@" % url_creds, 1) - response = self.fetch(**dict(path=url) | kwargs) - response.rethrow() - echoed_headers = json_decode(response.body) -@@ -799,17 +804,27 @@ def test_strip_headers_on_redirect(self): - "/redirect?url=%s&status=302" % self.get_url("/echo_headers") - ) - if url_creds: -- url = url.replace("http://", "http://%s@" % url_creds) -+ url = url.replace("http://", "http://%s@" % url_creds, 1) - response = self.fetch(**dict(path=url) | kwargs) - response.rethrow() - echoed_headers = json_decode(response.body) - # Confirm that non-auth headers are getting through - self.assertIn("User-Agent", echoed_headers) -- # Auth headers are not stripped when the redirect is same-origin. -- # Each of our tests uses one of these headers, but not both. -- self.assertTrue( -- "Authorization" in echoed_headers or "Cookie" in echoed_headers -- ) -+ if name == "credentials in URL": -+ # Some libcurl versions (known regression as of 8.20/8.21, -+ # still present as of curl's git master) drop credentials -+ # embedded in the URL across a same-origin redirect whose -+ # Location header is an absolute URL, even though they -+ # should be preserved. This isn't a security concern -+ # (nothing is leaked to another origin), so just don't -+ # assert on it either way here. -+ pass -+ else: -+ # Auth headers are not stripped when the redirect is same-origin. -+ # Each of our tests uses one of these headers, but not both. -+ self.assertTrue( -+ "Authorization" in echoed_headers or "Cookie" in echoed_headers -+ ) - - - class RequestProxyTest(unittest.TestCase): diff --git a/dev-python/tornado/tornado-6.5.7.ebuild b/dev-python/tornado/tornado-6.5.7.ebuild deleted file mode 100644 index ed2542ccdd51..000000000000 --- a/dev-python/tornado/tornado-6.5.7.ebuild +++ /dev/null @@ -1,63 +0,0 @@ -# Copyright 1999-2026 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -DISTUTILS_EXT=1 -DISTUTILS_USE_PEP517=setuptools -PYPI_VERIFY_REPO=https://github.com/tornadoweb/tornado -PYTHON_COMPAT=( python3_{13..14} ) -PYTHON_REQ_USE="threads(+)" - -inherit distutils-r1 pypi - -DESCRIPTION="Python web framework and asynchronous networking library" -HOMEPAGE=" - https://www.tornadoweb.org/ - https://github.com/tornadoweb/tornado/ - https://pypi.org/project/tornado/ -" - -LICENSE="Apache-2.0" -SLOT="0" -KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos" -IUSE="test" -RESTRICT="!test? ( test )" - -RDEPEND=" - >=dev-python/twisted-16.0.0[${PYTHON_USEDEP}] -" -BDEPEND=" - test? ( - ${RDEPEND} - $(python_gen_cond_dep ' - >=dev-python/pycurl-7.19.3.1[${PYTHON_USEDEP}] - ' 'python*') - ) -" - -PATCHES=( - "${FILESDIR}/${PN}-6.3.2-ignore-deprecationwarning.patch" - # https://github.com/tornadoweb/tornado/pull/3678 - "${FILESDIR}/${P}-pycurl-7.47.0.patch" -) - -src_prepare() { - # network-sandbox? ipv6? - sed -i -e 's:test_localhost:_&:' \ - tornado/test/netutil_test.py || die - - distutils-r1_src_prepare -} - -python_test() { - local -x ASYNC_TEST_TIMEOUT=60 - # Avoid time-sensitive tests - # https://github.com/tornadoweb/tornado/blob/10974e6ebee80a26a2a65bb9bd715cf858fafde5/tornado/test/util.py#L19 - local -x TRAVIS=1 - local -x NO_NETWORK=1 - - cd "${T}" || die - "${EPYTHON}" -m tornado.test.runtests --verbose || - die "tests failed under ${EPYTHON}" -} diff --git a/dev-python/tornado/tornado-6.5.9.ebuild b/dev-python/tornado/tornado-6.5.9.ebuild new file mode 100644 index 000000000000..34eff013d738 --- /dev/null +++ b/dev-python/tornado/tornado-6.5.9.ebuild @@ -0,0 +1,61 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +DISTUTILS_EXT=1 +DISTUTILS_USE_PEP517=setuptools +PYPI_VERIFY_REPO=https://github.com/tornadoweb/tornado +PYTHON_COMPAT=( python3_{13..14} ) +PYTHON_REQ_USE="threads(+)" + +inherit distutils-r1 pypi + +DESCRIPTION="Python web framework and asynchronous networking library" +HOMEPAGE=" + https://www.tornadoweb.org/ + https://github.com/tornadoweb/tornado/ + https://pypi.org/project/tornado/ +" + +LICENSE="Apache-2.0" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos" +IUSE="test" +RESTRICT="!test? ( test )" + +RDEPEND=" + >=dev-python/twisted-16.0.0[${PYTHON_USEDEP}] +" +BDEPEND=" + test? ( + ${RDEPEND} + $(python_gen_cond_dep ' + >=dev-python/pycurl-7.19.3.1[${PYTHON_USEDEP}] + ' 'python*') + ) +" + +PATCHES=( + "${FILESDIR}/${PN}-6.3.2-ignore-deprecationwarning.patch" +) + +src_prepare() { + # network-sandbox? ipv6? + sed -i -e 's:test_localhost:_&:' \ + tornado/test/netutil_test.py || die + + distutils-r1_src_prepare +} + +python_test() { + local -x ASYNC_TEST_TIMEOUT=60 + # Avoid time-sensitive tests + # https://github.com/tornadoweb/tornado/blob/10974e6ebee80a26a2a65bb9bd715cf858fafde5/tornado/test/util.py#L19 + local -x TRAVIS=1 + local -x NO_NETWORK=1 + + cd "${T}" || die + "${EPYTHON}" -m tornado.test.runtests --verbose || + die "tests failed under ${EPYTHON}" +} -- cgit v1.3