CVS commit: pkgsrc/www/py-gunicorn

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue May  7 04:03:52 UTC 2024

Modified Files:
        pkgsrc/www/py-gunicorn: Makefile PLIST distinfo

Log Message:
py-gunicorn: updated to 22.0.0

22.0.0 - 2024-04-17
===================

- use `utime` to notify workers liveness
- migrate setup to pyproject.toml
- fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
- parsing additional requests is no longer attempted past unsupported request framing
- on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
- requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
- Trailer fields are no longer inspected for headers indicating secure scheme
- support Python 3.12

** Breaking changes **

- minimum version is Python 3.7
- the limitations on valid characters in the HTTP method have been bounded to Internet Standards
- requests specifying unsupported transfer coding (order) are refused by default (rare)
- HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
- HTTP methods containing the number sign (#) are no longer accepted by default (rare)
- HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
- HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
- HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
- HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
- requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
- empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

- fix CVE-2024-1135


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/py-gunicorn/Makefile
cvs rdiff -u -r1.13 -r1.14 pkgsrc/www/py-gunicorn/PLIST
cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/py-gunicorn/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-gunicorn/Makefile
diff -u pkgsrc/www/py-gunicorn/Makefile:1.23 pkgsrc/www/py-gunicorn/Makefile:1.24
--- pkgsrc/www/py-gunicorn/Makefile:1.23        Fri Jul 21 06:20:39 2023
+++ pkgsrc/www/py-gunicorn/Makefile     Tue May  7 04:03:52 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.23 2023/07/21 06:20:39 adam Exp $
+# $NetBSD: Makefile,v 1.24 2024/05/07 04:03:52 adam Exp $
 
-DISTNAME=      gunicorn-21.2.0
+DISTNAME=      gunicorn-22.0.0
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=g/gunicorn/}
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
@@ -10,23 +10,20 @@ HOMEPAGE=   https://gunicorn.org/
 COMMENT=       Python WSGI HTTP server
 LICENSE=       mit
 
+TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=61.2:../../devel/py-setuptools
+TOOL_DEPENDS+= ${PYPKGPREFIX}-wheel-[0-9]*:../../devel/py-wheel
 DEPENDS+=      ${PYPKGPREFIX}-packaging-[0-9]*:../../devel/py-packaging
 TEST_DEPENDS+= ${PYPKGPREFIX}-cryptography-[0-9]*:../../security/py-cryptography
 TEST_DEPENDS+= ${PYPKGPREFIX}-gevent-[0-9]*:../../net/py-gevent
-TEST_DEPENDS+= ${PYPKGPREFIX}-test>=3.0.5:../../devel/py-test
-TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov>=2.4.0:../../devel/py-test-cov
-TEST_DEPENDS+= ${PYPKGPREFIX}-test-runner-[0-9]*:../../devel/py-test-runner
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov-[0-9]*:../../devel/py-test-cov
 
 USE_LANGUAGES= # none
 
-USE_PKG_RESOURCES=     yes
-PYSETUPTESTTARGET=     pytest
-
 PYTHON_VERSIONS_INCOMPATIBLE=  27
 
 post-install:
        cd ${DESTDIR}${PREFIX}/bin && \
        ${MV} gunicorn gunicorn-${PYVERSSUFFIX} || ${TRUE}
 
-.include "../../lang/python/egg.mk"
+.include "../../lang/python/wheel.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/www/py-gunicorn/PLIST
diff -u pkgsrc/www/py-gunicorn/PLIST:1.13 pkgsrc/www/py-gunicorn/PLIST:1.14
--- pkgsrc/www/py-gunicorn/PLIST:1.13   Tue Apr  6 15:50:44 2021
+++ pkgsrc/www/py-gunicorn/PLIST        Tue May  7 04:03:52 2024
@@ -1,12 +1,11 @@
-@comment $NetBSD: PLIST,v 1.13 2021/04/06 15:50:44 adam Exp $
+@comment $NetBSD: PLIST,v 1.14 2024/05/07 04:03:52 adam Exp $
 bin/gunicorn-${PYVERSSUFFIX}
-${PYSITELIB}/${EGG_INFODIR}/PKG-INFO
-${PYSITELIB}/${EGG_INFODIR}/SOURCES.txt
-${PYSITELIB}/${EGG_INFODIR}/dependency_links.txt
-${PYSITELIB}/${EGG_INFODIR}/entry_points.txt
-${PYSITELIB}/${EGG_INFODIR}/not-zip-safe
-${PYSITELIB}/${EGG_INFODIR}/requires.txt
-${PYSITELIB}/${EGG_INFODIR}/top_level.txt
+${PYSITELIB}/${WHEEL_INFODIR}/LICENSE
+${PYSITELIB}/${WHEEL_INFODIR}/METADATA
+${PYSITELIB}/${WHEEL_INFODIR}/RECORD
+${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
+${PYSITELIB}/${WHEEL_INFODIR}/entry_points.txt
+${PYSITELIB}/${WHEEL_INFODIR}/top_level.txt
 ${PYSITELIB}/gunicorn/__init__.py
 ${PYSITELIB}/gunicorn/__init__.pyc
 ${PYSITELIB}/gunicorn/__init__.pyo

Index: pkgsrc/www/py-gunicorn/distinfo
diff -u pkgsrc/www/py-gunicorn/distinfo:1.17 pkgsrc/www/py-gunicorn/distinfo:1.18
--- pkgsrc/www/py-gunicorn/distinfo:1.17        Fri Jul 21 06:20:39 2023
+++ pkgsrc/www/py-gunicorn/distinfo     Tue May  7 04:03:52 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2023/07/21 06:20:39 adam Exp $
+$NetBSD: distinfo,v 1.18 2024/05/07 04:03:52 adam Exp $
 
-BLAKE2s (gunicorn-21.2.0.tar.gz) = e4fac4585a9aeeabcb23333b9ab27823f150eb6d2de2a5cfa59e97a1539eee2d
-SHA512 (gunicorn-21.2.0.tar.gz) = 5d3117133ecbf9b8fded9c0ce69206916d273c284726d2a62e1d1d107560f22593baab032afa51e71b004a8b1e47afafd3fd1350b850ca45c1d7064075b795d3
-Size (gunicorn-21.2.0.tar.gz) = 3632557 bytes
+BLAKE2s (gunicorn-22.0.0.tar.gz) = c5281cec2d226fcdf52e4ac0ea18dd9bdf3640b64766047e48664a84225dcdea
+SHA512 (gunicorn-22.0.0.tar.gz) = f015eb6e413469d76e71055efd210460521c549f98bf7c5cbd93d075e55e5b9e354cf417aec2688cc24595840c67e255ff0bf15c0bf87f686b3d9769d01f1a88
+Size (gunicorn-22.0.0.tar.gz) = 3639760 bytes