CVS commit: pkgsrc/www/py-waitress

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/www/py-waitress
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Fri, 26 Jan 2024 13:48:21 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Jan 26 13:48:21 UTC 2024

Modified Files:
        pkgsrc/www/py-waitress: Makefile PLIST distinfo

Log Message:
py-waitress: updated to 2.1.2

2.1.2
-----

Bugfix
~~~~~~

- When expose_tracebacks is enabled waitress would fail to properly encode
  unicode thereby causing another error during error handling. See
  https://github.com/Pylons/waitress/pull/378

- Header length checking had a calculation that was done incorrectly when the
  data was received across multple socket reads. This calculation has been
  corrected, and no longer will Waitress send back a 413 Request Entity Too
  Large. See https://github.com/Pylons/waitress/pull/376

Security Bugfix
~~~~~~~~~~~~~~~

- in 2.1.0 a new feature was introduced that allowed the WSGI thread to start
  sending data to the socket. However this introduced a race condition whereby
  a socket may be closed in the sending thread while the main thread is about
  to call select() therey causing the entire application to be taken down.
  Waitress will no longer close the socket in the WSGI thread, instead waking
  up the main thread to cleanup. See https://github.com/Pylons/waitress/pull/377

2.1.1
-----

Security Bugfix
~~~~~~~~~~~~~~~

- Waitress now validates that chunked encoding extensions are valid, and don't
  contain invalid characters that are not allowed. They are still skipped/not
  processed, but if they contain invalid data we no longer continue in and
  return a 400 Bad Request. This stops potential HTTP desync/HTTP request
  smuggling. Thanks to Zhang Zeyu for reporting this issue. See
  https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36

- Waitress now validates that the chunk length is only valid hex digits when
  parsing chunked encoding, and values such as ``0x01`` and ``+01`` are no
  longer supported. This stops potential HTTP desync/HTTP request smuggling.
  Thanks to Zhang Zeyu for reporting this issue. See
  https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36

- Waitress now validates that the Content-Length sent by a remote contains only
  digits in accordance with RFC7230 and will return a 400 Bad Request when the
  Content-Length header contains invalid data, such as ``+10`` which would
  previously get parsed as ``10`` and accepted. This stops potential HTTP
  desync/HTTP request smuggling Thanks to Zhang Zeyu for reporting this issue. See
  https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36

2.1.0
-----

Python Version Support
~~~~~~~~~~~~~~~~~~~~~~

- Python 3.6 is no longer supported by Waitress

- Python 3.10 is fully supported by Waitress

Bugfix
~~~~~~

- ``wsgi.file_wrapper`` now sets the ``seekable``, ``seek``, and ``tell``
  attributes from the underlying file if the underlying file is seekable. This
  allows WSGI middleware to implement things like range requests for example

  See https://github.com/Pylons/waitress/issues/359 and
  https://github.com/Pylons/waitress/pull/363

- In Python 3 ``OSError`` is no longer subscriptable, this caused failures on
  Windows attempting to loop to find an socket that would work for use in the
  trigger.

  See https://github.com/Pylons/waitress/pull/361

- Fixed an issue whereby ``BytesIO`` objects were not properly closed, and
  thereby would not get cleaned up until garbage collection would get around to
  it.

  This led to potential for random memory spikes/memory issues, see
  https://github.com/Pylons/waitress/pull/358 and
  https://github.com/Pylons/waitress/issues/357 .

  With thanks to Florian Schulze for testing/vaidating this fix!

Features
~~~~~~~~

- When the WSGI app starts sending data to the output buffer, we now attempt to
  send data directly to the socket. This avoids needing to wake up the main
  thread to start sending data. Allowing faster transmission of the first byte.
  See https://github.com/Pylons/waitress/pull/364

  With thanks to Michael Merickel for being a great rubber ducky!

- Add REQUEST_URI to the WSGI environment.

  REQUEST_URI is similar to ``request_uri`` in nginx. It is a string that
  contains the request path before separating the query string and
  decoding ``%``-escaped characters.


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 pkgsrc/www/py-waitress/Makefile
cvs rdiff -u -r1.6 -r1.7 pkgsrc/www/py-waitress/PLIST
cvs rdiff -u -r1.11 -r1.12 pkgsrc/www/py-waitress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-waitress/Makefile
diff -u pkgsrc/www/py-waitress/Makefile:1.12 pkgsrc/www/py-waitress/Makefile:1.13
--- pkgsrc/www/py-waitress/Makefile:1.12        Wed Aug 24 09:25:57 2022
+++ pkgsrc/www/py-waitress/Makefile     Fri Jan 26 13:48:21 2024
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.12 2022/08/24 09:25:57 wiz Exp $
+# $NetBSD: Makefile,v 1.13 2024/01/26 13:48:21 adam Exp $
 
-DISTNAME=      waitress-1.4.3
+DISTNAME=      waitress-2.1.2
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
-PKGREVISION=   2
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=w/waitress/}
 
@@ -11,18 +10,15 @@ HOMEPAGE=   https://github.com/Pylons/wait
 COMMENT=       Production-quality pure-Python WSGI server
 LICENSE=       zpl-2.1
 
-TEST_DEPENDS+= ${PYPKGPREFIX}-nose-[0-9]*:../../devel/py-nose
+TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=41:../../devel/py-setuptools
+TOOL_DEPENDS+= ${PYPKGPREFIX}-wheel-[0-9]*:../../devel/py-wheel
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov-[0-9]*:../../devel/py-test-cov
 
 USE_LANGUAGES= # none
 
-PYTHON_VERSIONED_DEPENDENCIES+=        coverage:test
-
-USE_PKG_RESOURCES=     yes
-
 post-install:
        cd ${DESTDIR}${PREFIX}/bin && \
        ${MV} waitress-serve waitress-serve-${PYVERSSUFFIX} || ${TRUE}
 
-.include "../../lang/python/versioned_dependencies.mk"
-.include "../../lang/python/egg.mk"
+.include "../../lang/python/wheel.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/www/py-waitress/PLIST
diff -u pkgsrc/www/py-waitress/PLIST:1.6 pkgsrc/www/py-waitress/PLIST:1.7
--- pkgsrc/www/py-waitress/PLIST:1.6    Wed May 13 14:43:28 2020
+++ pkgsrc/www/py-waitress/PLIST        Fri Jan 26 13:48:21 2024
@@ -1,12 +1,11 @@
-@comment $NetBSD: PLIST,v 1.6 2020/05/13 14:43:28 adam Exp $
+@comment $NetBSD: PLIST,v 1.7 2024/01/26 13:48:21 adam Exp $
 bin/waitress-serve-${PYVERSSUFFIX}
-${PYSITELIB}/${EGG_INFODIR}/PKG-INFO
-${PYSITELIB}/${EGG_INFODIR}/SOURCES.txt
-${PYSITELIB}/${EGG_INFODIR}/dependency_links.txt
-${PYSITELIB}/${EGG_INFODIR}/entry_points.txt
-${PYSITELIB}/${EGG_INFODIR}/not-zip-safe
-${PYSITELIB}/${EGG_INFODIR}/requires.txt
-${PYSITELIB}/${EGG_INFODIR}/top_level.txt
+${PYSITELIB}/${WHEEL_INFODIR}/LICENSE.txt
+${PYSITELIB}/${WHEEL_INFODIR}/METADATA
+${PYSITELIB}/${WHEEL_INFODIR}/RECORD
+${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
+${PYSITELIB}/${WHEEL_INFODIR}/entry_points.txt
+${PYSITELIB}/${WHEEL_INFODIR}/top_level.txt
 ${PYSITELIB}/waitress/__init__.py
 ${PYSITELIB}/waitress/__init__.pyc
 ${PYSITELIB}/waitress/__init__.pyo
@@ -46,91 +45,6 @@ ${PYSITELIB}/waitress/server.pyo
 ${PYSITELIB}/waitress/task.py
 ${PYSITELIB}/waitress/task.pyc
 ${PYSITELIB}/waitress/task.pyo
-${PYSITELIB}/waitress/tests/__init__.py
-${PYSITELIB}/waitress/tests/__init__.pyc
-${PYSITELIB}/waitress/tests/__init__.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/__init__.py
-${PYSITELIB}/waitress/tests/fixtureapps/__init__.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/__init__.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/badcl.py
-${PYSITELIB}/waitress/tests/fixtureapps/badcl.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/badcl.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/echo.py
-${PYSITELIB}/waitress/tests/fixtureapps/echo.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/echo.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/error.py
-${PYSITELIB}/waitress/tests/fixtureapps/error.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/error.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/filewrapper.py
-${PYSITELIB}/waitress/tests/fixtureapps/filewrapper.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/filewrapper.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/getline.py
-${PYSITELIB}/waitress/tests/fixtureapps/getline.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/getline.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/groundhog1.jpg
-${PYSITELIB}/waitress/tests/fixtureapps/nocl.py
-${PYSITELIB}/waitress/tests/fixtureapps/nocl.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/nocl.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/runner.py
-${PYSITELIB}/waitress/tests/fixtureapps/runner.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/runner.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/sleepy.py
-${PYSITELIB}/waitress/tests/fixtureapps/sleepy.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/sleepy.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/toolarge.py
-${PYSITELIB}/waitress/tests/fixtureapps/toolarge.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/toolarge.pyo
-${PYSITELIB}/waitress/tests/fixtureapps/writecb.py
-${PYSITELIB}/waitress/tests/fixtureapps/writecb.pyc
-${PYSITELIB}/waitress/tests/fixtureapps/writecb.pyo
-${PYSITELIB}/waitress/tests/test_adjustments.py
-${PYSITELIB}/waitress/tests/test_adjustments.pyc
-${PYSITELIB}/waitress/tests/test_adjustments.pyo
-${PYSITELIB}/waitress/tests/test_buffers.py
-${PYSITELIB}/waitress/tests/test_buffers.pyc
-${PYSITELIB}/waitress/tests/test_buffers.pyo
-${PYSITELIB}/waitress/tests/test_channel.py
-${PYSITELIB}/waitress/tests/test_channel.pyc
-${PYSITELIB}/waitress/tests/test_channel.pyo
-${PYSITELIB}/waitress/tests/test_compat.py
-${PYSITELIB}/waitress/tests/test_compat.pyc
-${PYSITELIB}/waitress/tests/test_compat.pyo
-${PYSITELIB}/waitress/tests/test_functional.py
-${PYSITELIB}/waitress/tests/test_functional.pyc
-${PYSITELIB}/waitress/tests/test_functional.pyo
-${PYSITELIB}/waitress/tests/test_init.py
-${PYSITELIB}/waitress/tests/test_init.pyc
-${PYSITELIB}/waitress/tests/test_init.pyo
-${PYSITELIB}/waitress/tests/test_parser.py
-${PYSITELIB}/waitress/tests/test_parser.pyc
-${PYSITELIB}/waitress/tests/test_parser.pyo
-${PYSITELIB}/waitress/tests/test_proxy_headers.py
-${PYSITELIB}/waitress/tests/test_proxy_headers.pyc
-${PYSITELIB}/waitress/tests/test_proxy_headers.pyo
-${PYSITELIB}/waitress/tests/test_receiver.py
-${PYSITELIB}/waitress/tests/test_receiver.pyc
-${PYSITELIB}/waitress/tests/test_receiver.pyo
-${PYSITELIB}/waitress/tests/test_regression.py
-${PYSITELIB}/waitress/tests/test_regression.pyc
-${PYSITELIB}/waitress/tests/test_regression.pyo
-${PYSITELIB}/waitress/tests/test_runner.py
-${PYSITELIB}/waitress/tests/test_runner.pyc
-${PYSITELIB}/waitress/tests/test_runner.pyo
-${PYSITELIB}/waitress/tests/test_server.py
-${PYSITELIB}/waitress/tests/test_server.pyc
-${PYSITELIB}/waitress/tests/test_server.pyo
-${PYSITELIB}/waitress/tests/test_task.py
-${PYSITELIB}/waitress/tests/test_task.pyc
-${PYSITELIB}/waitress/tests/test_task.pyo
-${PYSITELIB}/waitress/tests/test_trigger.py
-${PYSITELIB}/waitress/tests/test_trigger.pyc
-${PYSITELIB}/waitress/tests/test_trigger.pyo
-${PYSITELIB}/waitress/tests/test_utilities.py
-${PYSITELIB}/waitress/tests/test_utilities.pyc
-${PYSITELIB}/waitress/tests/test_utilities.pyo
-${PYSITELIB}/waitress/tests/test_wasyncore.py
-${PYSITELIB}/waitress/tests/test_wasyncore.pyc
-${PYSITELIB}/waitress/tests/test_wasyncore.pyo
 ${PYSITELIB}/waitress/trigger.py
 ${PYSITELIB}/waitress/trigger.pyc
 ${PYSITELIB}/waitress/trigger.pyo

Index: pkgsrc/www/py-waitress/distinfo
diff -u pkgsrc/www/py-waitress/distinfo:1.11 pkgsrc/www/py-waitress/distinfo:1.12
--- pkgsrc/www/py-waitress/distinfo:1.11        Tue Oct 26 11:30:50 2021
+++ pkgsrc/www/py-waitress/distinfo     Fri Jan 26 13:48:21 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.11 2021/10/26 11:30:50 nia Exp $
+$NetBSD: distinfo,v 1.12 2024/01/26 13:48:21 adam Exp $
 
-BLAKE2s (waitress-1.4.3.tar.gz) = 854f342e6b64f10c8fbdffa2e0a8fc00142500fa41a55a735e82ccbf4e1016d2
-SHA512 (waitress-1.4.3.tar.gz) = b4fd6d174fe63d83686708ffb83f61421e94cc6c6e9ebc7deeae93ea50a0c11ee523d4448e602ba03ade942912accb33d482c13a367d7dcba61ba6b4871bc3b4
-Size (waitress-1.4.3.tar.gz) = 173767 bytes
+BLAKE2s (waitress-2.1.2.tar.gz) = e6a20380dd33e3505502c7e5e7bfffea98e363f1d5cd5a3dde5c0cc809ab0016
+SHA512 (waitress-2.1.2.tar.gz) = 4ef487e116b34eede0f04a02ca7a78116a91664814067a8562d1cd15a4ab702e5faf4be7c122478324d017b6bb1f5315633b74405d00e900b34cc8f1a068da59
+Size (waitress-2.1.2.tar.gz) = 179823 bytes

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/www/py-PasteDeploy
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/www/py-PasteDeploy
Indexes:

Home | Main Index | Thread Index | Old Index