Content-Transfer-Encoding: 7bit
Content-Type: multipart/mixed; boundary="_----------=_1715054633206030"
MIME-Version: 1.0
Date: Tue, 7 May 2024 04:03:53 +0000
From: "Adam Ciarcinski" <adam@netbsd.org>
Subject: CVS commit: pkgsrc/www/py-gunicorn
To: pkgsrc-changes@NetBSD.org
Reply-To: adam@netbsd.org
Message-Id: <20240507040353.123BFFA2C@cvs.NetBSD.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

This is a multi-part message in MIME format.

--_----------=_1715054633206030
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"

Module Name:	pkgsrc
Committed By:	adam
Date:		Tue May  7 04:03:52 UTC 2024

Modified Files:
	pkgsrc/www/py-gunicorn: Makefile PLIST distinfo

Log Message:
py-gunicorn: updated to 22.0.0

22.0.0 - 2024-04-17
===================

- use `utime` to notify workers liveness
- migrate setup to pyproject.toml
- fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
- parsing additional requests is no longer attempted past unsupported request framing
- on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
- requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
- Trailer fields are no longer inspected for headers indicating secure scheme
- support Python 3.12

** Breaking changes **

- minimum version is Python 3.7
- the limitations on valid characters in the HTTP method have been bounded to Internet Standards
- requests specifying unsupported transfer coding (order) are refused by default (rare)
- HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
- HTTP methods containing the number sign (#) are no longer accepted by default (rare)
- HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
- HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
- HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
- HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
- requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
- empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

- fix CVE-2024-1135


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/py-gunicorn/Makefile
cvs rdiff -u -r1.13 -r1.14 pkgsrc/www/py-gunicorn/PLIST
cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/py-gunicorn/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


--_----------=_1715054633206030
Content-Disposition: inline
Content-Length: 3700
Content-Transfer-Encoding: binary
Content-Type: text/x-diff; charset=us-ascii

Modified files:

Index: pkgsrc/www/py-gunicorn/Makefile
diff -u pkgsrc/www/py-gunicorn/Makefile:1.23 pkgsrc/www/py-gunicorn/Makefile:1.24
--- pkgsrc/www/py-gunicorn/Makefile:1.23	Fri Jul 21 06:20:39 2023
+++ pkgsrc/www/py-gunicorn/Makefile	Tue May  7 04:03:52 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.23 2023/07/21 06:20:39 adam Exp $
+# $NetBSD: Makefile,v 1.24 2024/05/07 04:03:52 adam Exp $
 
-DISTNAME=	gunicorn-21.2.0
+DISTNAME=	gunicorn-22.0.0
 CATEGORIES=	www python
 MASTER_SITES=	${MASTER_SITE_PYPI:=g/gunicorn/}
 PKGNAME=	${PYPKGPREFIX}-${DISTNAME}
@@ -10,23 +10,20 @@ HOMEPAGE=	https://gunicorn.org/
 COMMENT=	Python WSGI HTTP server
 LICENSE=	mit
 
+TOOL_DEPENDS+=	${PYPKGPREFIX}-setuptools>=61.2:../../devel/py-setuptools
+TOOL_DEPENDS+=	${PYPKGPREFIX}-wheel-[0-9]*:../../devel/py-wheel
 DEPENDS+=	${PYPKGPREFIX}-packaging-[0-9]*:../../devel/py-packaging
 TEST_DEPENDS+=	${PYPKGPREFIX}-cryptography-[0-9]*:../../security/py-cryptography
 TEST_DEPENDS+=	${PYPKGPREFIX}-gevent-[0-9]*:../../net/py-gevent
-TEST_DEPENDS+=	${PYPKGPREFIX}-test>=3.0.5:../../devel/py-test
-TEST_DEPENDS+=	${PYPKGPREFIX}-test-cov>=2.4.0:../../devel/py-test-cov
-TEST_DEPENDS+=	${PYPKGPREFIX}-test-runner-[0-9]*:../../devel/py-test-runner
+TEST_DEPENDS+=	${PYPKGPREFIX}-test-cov-[0-9]*:../../devel/py-test-cov
 
 USE_LANGUAGES=	# none
 
-USE_PKG_RESOURCES=	yes
-PYSETUPTESTTARGET=	pytest
-
 PYTHON_VERSIONS_INCOMPATIBLE=	27
 
 post-install:
 	cd ${DESTDIR}${PREFIX}/bin && \
 	${MV} gunicorn gunicorn-${PYVERSSUFFIX} || ${TRUE}
 
-.include "../../lang/python/egg.mk"
+.include "../../lang/python/wheel.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/www/py-gunicorn/PLIST
diff -u pkgsrc/www/py-gunicorn/PLIST:1.13 pkgsrc/www/py-gunicorn/PLIST:1.14
--- pkgsrc/www/py-gunicorn/PLIST:1.13	Tue Apr  6 15:50:44 2021
+++ pkgsrc/www/py-gunicorn/PLIST	Tue May  7 04:03:52 2024
@@ -1,12 +1,11 @@
-@comment $NetBSD: PLIST,v 1.13 2021/04/06 15:50:44 adam Exp $
+@comment $NetBSD: PLIST,v 1.14 2024/05/07 04:03:52 adam Exp $
 bin/gunicorn-${PYVERSSUFFIX}
-${PYSITELIB}/${EGG_INFODIR}/PKG-INFO
-${PYSITELIB}/${EGG_INFODIR}/SOURCES.txt
-${PYSITELIB}/${EGG_INFODIR}/dependency_links.txt
-${PYSITELIB}/${EGG_INFODIR}/entry_points.txt
-${PYSITELIB}/${EGG_INFODIR}/not-zip-safe
-${PYSITELIB}/${EGG_INFODIR}/requires.txt
-${PYSITELIB}/${EGG_INFODIR}/top_level.txt
+${PYSITELIB}/${WHEEL_INFODIR}/LICENSE
+${PYSITELIB}/${WHEEL_INFODIR}/METADATA
+${PYSITELIB}/${WHEEL_INFODIR}/RECORD
+${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
+${PYSITELIB}/${WHEEL_INFODIR}/entry_points.txt
+${PYSITELIB}/${WHEEL_INFODIR}/top_level.txt
 ${PYSITELIB}/gunicorn/__init__.py
 ${PYSITELIB}/gunicorn/__init__.pyc
 ${PYSITELIB}/gunicorn/__init__.pyo

Index: pkgsrc/www/py-gunicorn/distinfo
diff -u pkgsrc/www/py-gunicorn/distinfo:1.17 pkgsrc/www/py-gunicorn/distinfo:1.18
--- pkgsrc/www/py-gunicorn/distinfo:1.17	Fri Jul 21 06:20:39 2023
+++ pkgsrc/www/py-gunicorn/distinfo	Tue May  7 04:03:52 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2023/07/21 06:20:39 adam Exp $
+$NetBSD: distinfo,v 1.18 2024/05/07 04:03:52 adam Exp $
 
-BLAKE2s (gunicorn-21.2.0.tar.gz) = e4fac4585a9aeeabcb23333b9ab27823f150eb6d2de2a5cfa59e97a1539eee2d
-SHA512 (gunicorn-21.2.0.tar.gz) = 5d3117133ecbf9b8fded9c0ce69206916d273c284726d2a62e1d1d107560f22593baab032afa51e71b004a8b1e47afafd3fd1350b850ca45c1d7064075b795d3
-Size (gunicorn-21.2.0.tar.gz) = 3632557 bytes
+BLAKE2s (gunicorn-22.0.0.tar.gz) = c5281cec2d226fcdf52e4ac0ea18dd9bdf3640b64766047e48664a84225dcdea
+SHA512 (gunicorn-22.0.0.tar.gz) = f015eb6e413469d76e71055efd210460521c549f98bf7c5cbd93d075e55e5b9e354cf417aec2688cc24595840c67e255ff0bf15c0bf87f686b3d9769d01f1a88
+Size (gunicorn-22.0.0.tar.gz) = 3639760 bytes


--_----------=_1715054633206030--