[rpms/python-wsgidav] epel9: update to 4.3.5

[rpms/python-wsgidav] epel9: update to 4.3.5

[Felix Schwarz]

A new commit has been pushed.

Repo   : rpms/python-wsgidav
Branch : epel9
Commit : b472f958c40fc3ab6f9adcc8df77b56e680ed513
Author : Felix Schwarz <fschwarz@fedoraproject.org>
Date   : 2026-08-01T11:33:36+02:00
Stats  : +93/-137 in 6 file(s)
URL    : https://src.fedoraproject.org/rpms/python-wsgidav/c/b472f958c40fc3ab6f9adcc8df77b56e680ed513?branch=epel9

Log:
update to 4.3.5

---
diff --git a/.gitignore b/.gitignore
index 75c225d..565fb14 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1 @@
-/wsgidav-4.3.0.tar.gz
-/wsgidav-4.3.2.tar.gz
-/wsgidav-4.3.3.tar.gz
+/wsgidav-*.tar.gz

diff --git a/991a23f5f5f3f46232eacd96666e23c1b5e110b5.patch b/991a23f5f5f3f46232eacd96666e23c1b5e110b5.patch
deleted file mode 100644
index c327c18..0000000
--- a/991a23f5f5f3f46232eacd96666e23c1b5e110b5.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 991a23f5f5f3f46232eacd96666e23c1b5e110b5 Mon Sep 17 00:00:00 2001
-From: Martin Wendt <github@wwwendt.de>
-Date: Sat, 10 May 2025 21:06:17 +0200
-Subject: [PATCH] Fix recursive import
-
-Close #340
----
- wsgidav/dav_error.py | 30 ++++++++++++++++++++++++------
- 1 file changed, 24 insertions(+), 6 deletions(-)
-
-diff --git a/wsgidav/dav_error.py b/wsgidav/dav_error.py
-index 3ca52b88..f45c8448 100644
---- a/wsgidav/dav_error.py
-+++ b/wsgidav/dav_error.py
-@@ -9,7 +9,7 @@
- import datetime
- from html import escape as html_escape
- 
--from wsgidav import util, xml_tools
-+from wsgidav import xml_tools
- from wsgidav.xml_tools import etree
- 
- __docformat__ = "reStructuredText"
-@@ -128,6 +128,22 @@
- PRECONDITION_CODE_PropfindFiniteDepth = "{DAV:}propfind-finite-depth"
- 
- 
-+def to_bytes(s, encoding="utf8"):
-+    """Convert a text string (unicode) to bytestring (str on Py2 and bytes on Py3)."""
-+    if type(s) is not bytes:
-+        s = bytes(s, encoding)
-+    return s
-+
-+
-+def to_str(s, encoding="utf8"):
-+    """Convert data to native str type (bytestring on Py2 and unicode on Py3)."""
-+    if type(s) is bytes:
-+        s = str(s, encoding)
-+    elif type(s) is not str:
-+        s = str(s)
-+    return s
-+
-+
- class DAVErrorCondition:
-     """May be embedded in :class:`DAVError` instances to store additional data."""
- 
-@@ -159,7 +175,7 @@ def as_xml(self):
-         return error_el
- 
-     def as_string(self):
--        return util.to_str(xml_tools.xml_to_bytes(self.as_xml(), pretty=True))
-+        return to_str(xml_tools.xml_to_bytes(self.as_xml(), pretty=True))
- 
- 
- # ========================================================================
-@@ -197,7 +213,7 @@ def __init__(
-         self.src_exception = src_exception
-         self.err_condition = err_condition
-         self.add_headers = add_headers
--        if util.is_str(err_condition):
-+        if isinstance(err_condition, str):
-             self.err_condition = DAVErrorCondition(err_condition)
-         assert (
-             self.err_condition is None or type(self.err_condition) is DAVErrorCondition
-@@ -230,11 +246,13 @@ def get_user_info(self):
- 
-     def get_response_page(self):
-         """Return a tuple (content-type, response page)."""
-+        from wsgidav.util import public_wsgidav_info
-+
-         # If it has pre- or post-condition: return as XML response
-         if self.err_condition:
-             return (
-                 "application/xml; charset=utf-8",
--                util.to_bytes(self.err_condition.as_string()),
-+                to_bytes(self.err_condition.as_string()),
-             )
- 
-         # Else return as HTML
-@@ -255,13 +273,13 @@ def get_response_page(self):
-         html.append("<hr/>")
-         html.append(
-             "<a href='https://github.com/mar10/wsgidav/'>{}</a> - {}".format(
--                util.public_wsgidav_info,
-+                public_wsgidav_info,
-                 html_escape(str(datetime.datetime.now()), "utf-8"),
-             )
-         )
-         html.append("</body></html>")
-         html = "\n".join(html)
--        return ("text/html; charset=utf-8", util.to_bytes(html))
-+        return ("text/html; charset=utf-8", to_bytes(html))
- 
- 
- def get_http_status_code(v):

diff --git a/python-wsgidav-fix-python39.patch b/python-wsgidav-fix-python39.patch
new file mode 100644
index 0000000..9992150
--- /dev/null
+++ b/python-wsgidav-fix-python39.patch
@@ -0,0 +1,85 @@
+From 015527b7db201411e240c83af057b37f95fdba80 Mon Sep 17 00:00:00 2001
+From: Felix Schwarz <felix.schwarz@oss.schwarz.eu>
+Date: Sat, 1 Aug 2026 11:11:00 +0200
+Subject: [PATCH] restore Python 3.9 compatibility
+
+---
+ tests/test_imports.py      | 37 +++++++++++++++++++++++++++++++++++++
+ wsgidav/mw/impersonator.py |  6 +++---
+ 2 files changed, 40 insertions(+), 3 deletions(-)
+ create mode 100644 tests/test_imports.py
+
+diff --git a/tests/test_imports.py b/tests/test_imports.py
+new file mode 100644
+index 00000000..f6c3c6f0
+--- /dev/null
++++ b/tests/test_imports.py
+@@ -0,0 +1,37 @@
++# (c) 2009-2026 Martin Wendt and contributors; see WsgiDAV https://github.com/mar10/wsgidav
++# Licensed under the MIT license:
++# http://www.opensource.org/licenses/mit-license.php
++"""Smoke test that asserts that every module can be imported."""
++
++import importlib
++import pkgutil
++
++import pytest
++
++import wsgidav
++
++
++def _reraise(module_name):
++    raise
++
++
++MODULE_NAMES = sorted(
++    info.name
++    # reraise ensures that import errors of subpackages are not silently ignored
++    for info in pkgutil.walk_packages(wsgidav.__path__, "wsgidav.", onerror=_reraise)
++)
++
++
++def test_finds_at_least_some_modules():
++    assert len(MODULE_NAMES) > 10
++
++
++@pytest.mark.parametrize("module_name", MODULE_NAMES)
++def test_module_is_importable(module_name):
++    try:
++        importlib.import_module(module_name)
++    except ImportError as e:
++        # accept missing optional or platform specific dependencies,
++        if e.name and e.name.partition(".")[0] == "wsgidav":
++            raise
++        pytest.skip(f"missing dependency {e.name!r}")
+diff --git a/wsgidav/mw/impersonator.py b/wsgidav/mw/impersonator.py
+index 0b6254d5..2db31d60 100644
+--- a/wsgidav/mw/impersonator.py
++++ b/wsgidav/mw/impersonator.py
+@@ -18,7 +18,7 @@
+ import os
+ import pwd
+ from contextlib import AbstractContextManager
+-from typing import Tuple
++from typing import Optional, Tuple
+ 
+ from wsgidav import util
+ from wsgidav.mw.base_mw import BaseMiddleware
+@@ -30,7 +30,7 @@
+ 
+ 
+ class ImpersonateContext(AbstractContextManager):
+-    def __init__(self, ids: Tuple[int, int] | None) -> None:
++    def __init__(self, ids: Optional[Tuple[int, int]]) -> None:
+         if ids is None:
+             self._enabled = False
+             return
+@@ -77,7 +77,7 @@ def __call__(self, environ, start_response):
+     def is_disabled(self):  # type: ignore
+         return not self.get_config("impersonator.enable", False)  # type: ignore
+ 
+-    def _map_id(self, username: str) -> Tuple[int, int] | None:
++    def _map_id(self, username: str) -> Optional[Tuple[int, int]]:
+         if self.is_disabled():
+             return None
+ 

diff --git a/python-wsgidav.spec b/python-wsgidav.spec
index b10cd2f..9eb6a7d 100644
--- a/python-wsgidav.spec
+++ b/python-wsgidav.spec
@@ -5,7 +5,7 @@
 %bcond mysqlclient 0
 
 Name:           python-wsgidav
-Version:        4.3.3
+Version:        4.3.5
 Release:        %autorelease
 Summary:        Generic and extendable WebDAV server based on WSGI
 
@@ -20,18 +20,8 @@ Source0:        %{url}/archive/v%{version}/wsgidav-%{version}.tar.gz
 # Man page hand-written for Fedora in groff_man(7) format based on --help
 Source1:        wsgidav.1
 
-# Fix recursive import
-# https://github.com/mar10/wsgidav/commit/991a23f5f5f3f46232eacd96666e23c1b5e110b5
-#
-# Fixes:
-#
-# Cannot import wsgidav.dav_error: raises ImportError due to circular import
-# https://github.com/mar10/wsgidav/issues/340#event-17603260087
-Patch0:         %{url}/commit/991a23f5f5f3f46232eacd96666e23c1b5e110b5.patch
-# Fix CVE-2026-48099
-# https://github.com/mar10/wsgidav/commit/f894ed8656d7bdd7438ab8148c5a02546cb15183
-# Without changelog entry, to avoid merge conflicts
-Patch1:         wsgidav-4.3.3-CVE-2026-48099.patch
+# https://github.com/mar10/wsgidav/pull/367
+Patch1:         python-wsgidav-fix-python39.patch
 
 BuildArch:      noarch
 
@@ -80,6 +70,8 @@ Summary:        %{summary}
 %prep
 %autosetup -n wsgidav-%{version} -p1
 
+sed --in-place 's/bcrypt>=4.0,<5/bcrypt<5/' setup.cfg
+
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_linters
 # - pytest-cov is a coverage tool
 # - pytest-html is not packaged, and is only used for generating reports
@@ -104,8 +96,6 @@ install -D --preserve-timestamps --mode=0644 \
 
 
 %check
-# - wsgidav.dav_error: Cannot import wsgidav.dav_error: raises ImportError due
-#   to circular import, https://github.com/mar10/wsgidav/issues/340
 # - wsgidav.dc.nt_dc: platform-specific (Windows); requires
 #   https://pypi.org/project/pywin32/, not packaged for obvious reasons
 # - wsgidav.prop_man.couch_property_manager: requires python-couchdb, retired
@@ -118,7 +108,6 @@ install -D --preserve-timestamps --mode=0644 \
 # - wsgidav.samples.mysql_dav_provider: requires python-mysqlclient, which *is*
 #   packaged, but which we do not want to pull in just for an import check
 %{pyproject_check_import %{shrink:
-                        -e wsgidav.dav_error
                         -e wsgidav.dc.nt_dc
                         -e wsgidav.prop_man.couch_property_manager
                         %{?!with_pymongo:-e wsgidav.prop_man.mongo_property_manager}
@@ -131,7 +120,7 @@ install -D --preserve-timestamps --mode=0644 \
 # pip-install pytest-html. Rather than patching this out (and patching out the
 # pytest arguments related to pytest-cov and pytest-html), we just run pytest
 # directly.
-%pytest -ra --verbose
+%pytest -ra --verbose tests
 
 
 %files -n python3-wsgidav -f %{pyproject_files}

diff --git a/sources b/sources
index f4830e8..b0b1f9a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (wsgidav-4.3.3.tar.gz) = 0238987ea5c0571072d9975670c7294e7153180db22a4104ddd77545b9f32f99afc0fb2fab291914b5f34bcc83c094a3f0daec6fadfeca154f714c37aa645e01
+SHA512 (wsgidav-4.3.5.tar.gz) = 6addbd7e7713b1cf8fb4254cb1bbba7374028c2a5f33b03d3110b0f7dc6f67b2a594a8944da1b345b774ef2143bf312f67c9f435f91cfc71fca769ddcc314434

diff --git a/wsgidav-4.3.3-CVE-2026-48099.patch b/wsgidav-4.3.3-CVE-2026-48099.patch
deleted file mode 100644
index b07318d..0000000
--- a/wsgidav-4.3.3-CVE-2026-48099.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/wsgidav/fs_dav_provider.py b/wsgidav/fs_dav_provider.py
-index de9b00c7..7b2b7c14 100644
---- a/wsgidav/fs_dav_provider.py
-+++ b/wsgidav/fs_dav_provider.py
-@@ -457,9 +457,14 @@ def _loc_to_file_path(self, path: str, environ: dict = None):
-         # Try alternative URL if not found (or even override target):
-         is_shadow, file_path = self._resolve_shadow_path(path, environ, file_path)
- 
--        if not file_path.startswith(root_path) and not is_shadow:
-+        # Ensure the containment check is path-boundary-aware: append os.sep so
-+        # that a sibling directory (e.g. /tmp/share_evil) whose name *starts with*
-+        # root_path (/tmp/share) is correctly rejected.
-+        root_path_with_sep = root_path.rstrip(os.sep) + os.sep
-+        file_path_with_sep = file_path.rstrip(os.sep) + os.sep
-+        if not file_path_with_sep.startswith(root_path_with_sep) and not is_shadow:
-             raise RuntimeError(
--                f"Security exception: tried to access file outside root: {file_path}"
-+                f"Security exception: tried to access file outside root {root_path}: {file_path}"
-             )
- 
-         # Convert to unicode