Dear Release Managers, I need guidance on how to proper handle this: requests version in testing is 2.4.3-4 but 2.4.3-5 was uploaded into unstable to fix #770173.
I already fixed on SVN #780506 but I did not uploaded requests 2.4.3-6 because I need your hint. This is the debdiff (requests_2.4.3-6.dsc built from SVN): ❯ debdiff requests_2.4.3-4.dsc requests_2.4.3-6.dsc dpkg-source: warning: extracting unsigned source package (/home/eriol/devel/debian/pkg/requests/build-area/requests_2.4.3-6.dsc) diff -Nru requests-2.4.3/debian/changelog requests-2.4.3/debian/changelog --- requests-2.4.3/debian/changelog 2014-11-14 09:33:09.000000000 +0100 +++ requests-2.4.3/debian/changelog 2015-03-16 03:48:27.000000000 +0100 @@ -1,3 +1,21 @@ +requests (2.4.3-6) UNRELEASED; urgency=medium + + * debian/patches/05_do-not-ascribe-cookies-to-the-target-domain.patch + - Fix session fixation and cookie stealing: CVE-2015-2296. + (Closes: #780506) + + -- Daniele Tricoli <[email protected]> Mon, 16 Mar 2015 01:31:10 +0100 + +requests (2.4.3-5) unstable; urgency=medium + + * Team upload. + * d/control: Remove the Build-Depends on python{,3}-pytest since we + aren't actually running the tests at build time. (Closes: #770173) + * d/rules: Update the comment about why the tests are currently disabled + at build time to point to the updated upstream url. + + -- Barry Warsaw <[email protected]> Wed, 19 Nov 2014 18:00:46 -0500 + requests (2.4.3-4) unstable; urgency=medium * debian/patches/04_make-requests.packages.urllib3-same-as-urllib3.patch diff -Nru requests-2.4.3/debian/control requests-2.4.3/debian/control --- requests-2.4.3/debian/control 2014-10-21 10:23:21.000000000 +0200 +++ requests-2.4.3/debian/control 2014-11-19 23:59:48.000000000 +0100 @@ -8,12 +8,10 @@ dh-python, python-all (>= 2.6.6-3), python-chardet, - python-pytest, python-setuptools, python-urllib3 (>= 1.9.1), python3-all, python3-chardet, - python3-pytest, python3-setuptools, python3-urllib3 (>= 1.7.1), python3-wheel diff -Nru requests-2.4.3/debian/patches/05_do-not-ascribe-cookies-to-the-target-domain.patch requests-2.4.3/debian/patches/05_do-not-ascribe-cookies-to-the-target-domain.patch --- requests-2.4.3/debian/patches/05_do-not-ascribe-cookies-to-the-target-domain.patch 1970-01-01 01:00:00.000000000 +0100 +++ requests-2.4.3/debian/patches/05_do-not-ascribe-cookies-to-the-target-domain.patch 2015-03-16 03:53:20.000000000 +0100 @@ -0,0 +1,17 @@ +Description: Session fixation and cookie stealing. + See http://www.openwall.com/lists/oss-security/2015/03/14/4 for a complete + description. +Origin: https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc +Bug-Debian: https://bugs.debian.org/780506 + +--- a/requests/sessions.py ++++ b/requests/sessions.py +@@ -168,7 +168,7 @@ + except KeyError: + pass + +- extract_cookies_to_jar(prepared_request._cookies, prepared_request, resp.raw) ++ extract_cookies_to_jar(prepared_request._cookies, req, resp.raw) + prepared_request._cookies.update(self.cookies) + prepared_request.prepare_cookies(prepared_request._cookies) + diff -Nru requests-2.4.3/debian/patches/series requests-2.4.3/debian/patches/series --- requests-2.4.3/debian/patches/series 2014-11-11 17:28:54.000000000 +0100 +++ requests-2.4.3/debian/patches/series 2015-03-16 03:53:20.000000000 +0100 @@ -2,3 +2,4 @@ 02_use-system-chardet-and-urllib3.patch 03_export-IncompleteRead.patch 04_make-requests.packages.urllib3-same-as-urllib3.patch +05_do-not-ascribe-cookies-to-the-target-domain.patch diff -Nru requests-2.4.3/debian/rules requests-2.4.3/debian/rules --- requests-2.4.3/debian/rules 2014-09-07 15:51:39.000000000 +0200 +++ requests-2.4.3/debian/rules 2014-11-19 23:59:48.000000000 +0100 @@ -9,9 +9,9 @@ # can't enable it. Once this issue is fixed, it will be easy to # re-enable. # -# https://github.com/kennethreitz/requests/issues/1166 +# https://github.com/kennethreitz/requests/issues/2184 # -# [email protected] 2014-06-04 +# [email protected] 2014-11-19 #override_dh_auto_test: # PYBUILD_SYSTEM=custom \ # PYBUILD_TEST_ARGS="{interpreter} test_requests.py" \ Since 2.4.3-5 only removed some B-D and explained better why tests can not be run, can I upload requests 2.4.3-6 and then fill an unblock request for it? Thanks in advance! Kind regards, -- Daniele Tricoli 'Eriol' http://mornie.org -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: https://lists.debian.org/2740575.Lsm0BTGnDn@mornie
