[rpms/rpkg] 1.70-1: Patch: Use ruff code checker instead of bandit

[rpms/rpkg] 1.70-1: Patch: Use ruff code checker instead of bandit

[@ 2026-08-10 21:44 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/rpkg
            Branch : 1.70-1
            Commit : fac9d4c1a99399e6fd6b423f04a92fc854d3e7b1
            Author : Ondřej Nosek <onosek@redhat.com>
            Date   : 2025-11-26T01:25:09+00:00
            Stats  : +261/-83 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/rpkg/c/fac9d4c1a99399e6fd6b423f04a92fc854d3e7b1?branch=1.70-1

            Log:
            Patch: Use ruff code checker instead of bandit

Signed-off-by: Ondřej Nosek <onosek@redhat.com>

---
diff --git a/0003-Use-ruff-code-checker-instead-of-bandit.patch b/0003-Use-ruff-code-checker-instead-of-bandit.patch
new file mode 100644
index 0000000..3081d04
--- /dev/null
+++ b/0003-Use-ruff-code-checker-instead-of-bandit.patch
@@ -0,0 +1,256 @@
+From 4187379b9c316aa245602f704ed9b88aac8d8c2c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Nosek?= <onosek@redhat.com>
+Date: Wed, 26 Nov 2025 00:11:47 +0100
+Subject: [PATCH] Use ruff code checker instead of bandit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In the testing CI (Jenkins), stop using bandit in favour of ruff.
+Bandit is deprecated in the latest Fedora release (F43).
+Added an environment for code coverage analysis.
+
+JIRA: RHELCMP-14985
+
+Signed-off-by: Ondřej Nosek <onosek@redhat.com>
+---
+ CONTRIBUTING.md         |  4 +++-
+ Jenkinsfile             |  2 +-
+ jenkins_test.dockerfile |  6 +++---
+ pyproject.toml          | 34 ++++++++++++++++++++++++++++++++++
+ pyrpkg/__init__.py      |  8 ++++----
+ pyrpkg/cli.py           |  2 +-
+ tests/test_cli.py       |  2 +-
+ tests/test_commands.py  |  6 +++---
+ tox.ini                 | 23 ++++++++++++++++++++---
+ 9 files changed, 70 insertions(+), 17 deletions(-)
+
+diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
+index b3c1d31..a14d3d5 100644
+--- a/CONTRIBUTING.md
++++ b/CONTRIBUTING.md
+@@ -32,11 +32,13 @@ You can increase the chance of your Pull Request being merged by:
+ * having good test coverage
+ * writing documentation
+ * following PEP 8 for code formatting
+-* don't have [bandit][bandit] complains
++* ~~don't have [bandit][bandit] complains~~ (not active in the Jenkins)
++* don't have [ruff][ruff] complains (some categories are currently excluded in the configuration)
+ * writing [a good commit message][commit-message]
+ 
+ [commit-message]: https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html
+ [bandit]: https://bandit.readthedocs.io
++[ruff]: https://github.com/astral-sh/ruff
+ 
+ 
+ [places]:
+diff --git a/Jenkinsfile b/Jenkinsfile
+index 9b38735..61872ed 100644
+--- a/Jenkinsfile
++++ b/Jenkinsfile
+@@ -49,7 +49,7 @@ git fetch proposed
+ git checkout "origin/$params.BRANCH_TO"
+ git merge --no-ff "proposed/$params.BRANCH" -m "Merge PR"
+ 
+-podman run --rm -v .:/src:Z quay.io/exd-guild-source-tools/rpkg-test:latest tox -e py36,py39,py312,py313,flake8,bandit --workdir /tmp/tox ${TOX_POSARGS}
++podman run --rm -v .:/src:Z quay.io/exd-guild-source-tools/rpkg-test:latest tox -e py36,py39,py312,py313,py314,flake8,ruff --workdir /tmp/tox ${TOX_POSARGS}
+ # disabled py27 environment for now; keep just flake8 for Python 2
+ podman run --rm -v .:/src:Z quay.io/exd-guild-source-tools/rpkg-test-py2:latest tox -e flake8python2 --workdir /tmp/tox ${TOX_POSARGS}
+                         """
+diff --git a/jenkins_test.dockerfile b/jenkins_test.dockerfile
+index 8ef932a..e950280 100644
+--- a/jenkins_test.dockerfile
++++ b/jenkins_test.dockerfile
+@@ -1,4 +1,4 @@
+-FROM fedora:41
++FROM fedora:42
+ LABEL \
+     name="rpkg test" \
+     description="Run tests using tox with Python 3" \
+@@ -27,11 +27,11 @@ RUN dnf -y install \
+         openssl-devel \
+         make \
+         git \
+-        bandit
++        ruff
+ RUN dnf clean all
+ 
+ WORKDIR /src
+ 
+ COPY . .
+ 
+-CMD ["tox", "-e", "py36,py39,py312,py313,py314,flake8,bandit"]
++CMD ["tox", "-e", "py36,py39,py312,py313,py314,flake8,ruff"]
+diff --git a/pyproject.toml b/pyproject.toml
+index 255a7bc..d9f30a7 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -87,3 +87,37 @@ include = [
+ packages = [
+     "pyrpkg",
+ ]
++
++[tool.ruff]
++line-length = 100
++
++[tool.ruff.lint]
++select = [
++    # pycodestyle
++    "E",
++    # pycodestyle warnings
++    "W",
++    # Pyflakes
++    "F",
++    # pyupgrade
++    #"UP",
++    # flake8-bugbear
++    #"B",
++    # flake8-simplify
++    #"SIM",
++    # isort
++    #"I",
++    # flake8-bandit
++    "S",
++    # flake8-type-checking
++    #"TCH",
++    # flake8-comprehensions
++    #"C4",
++    # pep8-naming
++    #"N",
++    # flake8-annotations
++    #"ANN",
++    # flake8-pytest-style
++    #"PT",
++]
++ignore = ["S101", "S311", "S603", "S607"]
+diff --git a/pyrpkg/__init__.py b/pyrpkg/__init__.py
+index 4d453ca..a4b4dd7 100644
+--- a/pyrpkg/__init__.py
++++ b/pyrpkg/__init__.py
+@@ -832,7 +832,7 @@ class Commands(object):
+         tmp_resultdir = tempfile.mkdtemp(prefix="mock_resultdir")
+         cmd += ['-r', root, '--chroot', '--resultdir', tmp_resultdir]
+ 
+-        tmp_root = '/var/tmp'  # temporary directory inside the mock root  # nosec
++        tmp_root = '/var/tmp'  # temporary directory inside the mock root  # nosec # noqa: S108
+         copyin_cmd = cmd + ['--copyin', specfile_path, tmp_root]
+ 
+         # We make sure there is a space at the end of our query so that
+@@ -1405,7 +1405,7 @@ class Commands(object):
+             # anyway.
+             if int(re.search(r'\d+', self.distval).group()) < 6:
+                 return 'md5'
+-        except Exception:
++        except Exception:  # noqa: S110
+             # An error here is OK, don't bother the user.
+             pass
+ 
+@@ -2004,7 +2004,7 @@ class Commands(object):
+             try:
+                 output = subprocess.check_output(cmd)
+                 hash = output.split()[0]
+-            except Exception:
++            except Exception:  # noqa: S110
+                 # don't do anything here, we'll handle not having hash
+                 # later
+                 pass
+@@ -4187,7 +4187,7 @@ class Commands(object):
+                 data = body
+             auth = requests_gssapi.HTTPSPNEGOAuth(
+                 mutual_authentication=requests_gssapi.OPTIONAL)
+-            resp = requests.request(verb, url, data=data, auth=auth, **kwargs)
++            resp = requests.request(verb, url, data=data, auth=auth, timeout=1800, **kwargs)
+             if resp.status_code == 401:
+                 raise rpkgError('MBS authentication using Kerberos failed. '
+                                 'Make sure you have a valid Kerberos ticket.')
+diff --git a/pyrpkg/cli.py b/pyrpkg/cli.py
+index decef3f..160baff 100644
+--- a/pyrpkg/cli.py
++++ b/pyrpkg/cli.py
+@@ -66,7 +66,7 @@ class _ArgumentParser(argparse.ArgumentParser):
+             return None
+ 
+         # if it doesn't start with a prefix, it was meant to be positional
+-        if not arg_string[0] in self.prefix_chars:
++        if arg_string[0] not in self.prefix_chars:
+             return None
+ 
+         # if the option string is present in the parser, return the action
+diff --git a/tests/test_cli.py b/tests/test_cli.py
+index f734c43..efe50f1 100644
+--- a/tests/test_cli.py
++++ b/tests/test_cli.py
+@@ -1475,7 +1475,7 @@ class LookasideCacheMock(object):
+             f.write('binary data')
+ 
+     def hash_file(self, filename):
+-        md5 = hashlib.md5()  # nosec
++        md5 = hashlib.md5()  # nosec # noqa: S324
+         with open(filename, 'rb') as f:
+             content = f.read()
+             md5.update(content)
+diff --git a/tests/test_commands.py b/tests/test_commands.py
+index b0b18a3..a757c7e 100644
+--- a/tests/test_commands.py
++++ b/tests/test_commands.py
+@@ -1113,11 +1113,11 @@ class TestRunCommand(CommandTestCase):
+     def test_run_command_within_shell(self, Popen):
+         Popen.return_value.wait.return_value = 0
+ 
+-        result = self.cmd._run_command(['rpmbuild'], shell=True)  # nosec
++        result = self.cmd._run_command(['rpmbuild'], shell=True)  # nosec # noqa: S604
+ 
+         self.assertEqual((0, None, None), result)
+-        Popen.assert_called_once_with(
+-            'rpmbuild', env=os.environ, shell=True, cwd=None,  # nosec
++        Popen.assert_called_once_with(   # nosec # noqa: S604
++            'rpmbuild', env=os.environ, shell=True, cwd=None,
+             stdin=subprocess.DEVNULL, stdout=None, stderr=None,
+             universal_newlines=False)
+ 
+diff --git a/tox.ini b/tox.ini
+index ccbdac2..8bf9c3f 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -1,5 +1,6 @@
+ [tox]
+-envlist = py27,py36,py39,py312,py313,py314,flake8,doc,bandit
++envlist = py27,py36,py39,py312,py313,py314,flake8,doc,bandit,coverage,ruff
++basepython = {env:TOXPYTHON:python3}
+ 
+ [testenv]
+ skip_install = True
+@@ -13,8 +14,6 @@ basepython=
+     py314: {env:TOXPYTHON:python3.14}
+     flake8: {env:TOXPYTHON:python3.6}
+     flake8python2: {env:TOXPYTHON:python2.7}
+-    doc: {env:TOXPYTHON:python3}
+-    bandit: {env:TOXPYTHON:python3}
+ 
+ deps =
+     -r{toxinidir}/requirements/pypi.txt
+@@ -71,3 +70,21 @@ skip_install = true
+ deps = bandit
+ commands = bandit -r -ll pyrpkg tests
+ ignore_outcome = False
++
++[testenv:coverage]
++deps =
++    {[testenv]deps}
++    pytest-cov
++skip_install = True
++commands =
++    python -m pytest --cov=pyrpkg --cov-report=term --cov-report=html {posargs}
++
++[coverage:run]
++source = pyrpkg
++omit =
++
++[testenv:ruff]
++deps = ruff
++skip_install = True
++commands =
++    python -m ruff check pyrpkg/ tests/
+-- 
+2.51.1
+

diff --git a/757.patch b/757.patch
deleted file mode 100644
index 1e64c66..0000000
--- a/757.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 0a2a54318ef5f57142a8fab05370e6824b0645da Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Oct 13 2025 09:59:52 +0000
-Subject: Accept auto-generated sources in pre-push checks
-
-
-The patch-git tool creates source files during spec file parsing.
-
-<https://gitlab.com/redhat/centos-stream/rpms/glibc/-/blob/c10s/patch-git.lua>
-
-With this change, the pre-push check recognizes the "auto-generated-/"
-source file prefix, so that patch-git can use it to bypass the check.
-(The rpmbuild tool ignores directory names.)
-
-Signed-off-by: Florian Weimer <fweimer@redhat.com>
-
----
-
-diff --git a/pyrpkg/__init__.py b/pyrpkg/__init__.py
-index a4e8b23..ee74fdc 100644
---- a/pyrpkg/__init__.py
-+++ b/pyrpkg/__init__.py
-@@ -4617,6 +4617,13 @@ class Commands(object):
-             match = SpecFile.sourcefile_expression.match(line)
-             if match:
-                 file_location = match.group('val')
-+                if file_location.startswith('auto-generated/'):
-+                    # This source file is auto-generated during SRPM
-+                    # construction.  It is not expected to be listed
-+                    # in source/checked into Git.  Skip it for the
-+                    # pre-push check.
-+                    continue
-+
-                 # find out the format of the source file path. From URL use just the file name.
-                 # We want to keep hierarchy of the files if possible
-                 res = urllib.parse.urlparse(file_location)
-diff --git a/tests/commands/test_pre_push_check.py b/tests/commands/test_pre_push_check.py
-index 0e9aaf7..df7d2b4 100644
---- a/tests/commands/test_pre_push_check.py
-+++ b/tests/commands/test_pre_push_check.py
-@@ -105,3 +105,40 @@ Patch3: d.patch
-         with open('sources', 'r') as f:
-             expected_sources_content = f.read().strip()
-         self.assertEqual(expected_sources_content, sources_content)
-+
-+    def test_push_is_not_blocked_with_autogenerated_sources(self):
-+        """
-+        Check that auto-generated/ source lines in the spec file
-+        do not result in push failures.
-+        """
-+        # Track SPEC and a.patch in Git.
-+        spec_file = self.module + ".spec"
-+        with open(spec_file, 'w') as f:
-+            f.write(SPECFILE_TEMPLATE % '''Patch0: a.patch
-+Patch2: c.patch
-+Source1: auto-generated/patch-git-generated-commit.txt
-+''')
-+
-+        for patch_file in ('a.patch', 'c.patch',
-+                           'patch-git-generated-commit.txt'):
-+            with open(patch_file, 'w') as f:
-+                f.write(patch_file)
-+
-+        # Track c.patch in sources
-+        sources_file = SourcesFile(self.cmd.sources_filename,
-+                                   self.cmd.source_entry_type)
-+        file_hash = self.cmd.lookasidecache.hash_file('c.patch')
-+        sources_file.add_entry(self.cmd.lookasidehash, 'c.patch', file_hash)
-+        sources_file.write()
-+
-+        self.cmd.repo.index.add([spec_file, 'a.patch', 'sources'])
-+        self.cmd.repo.index.commit('add SPEC and patches')
-+
-+        # The test attempts to connect to the lookaside cache.
-+
-+        def patch_remote_file_exists_head(name, filename, hash, hashtype):
-+            return filename == 'c.patch'
-+
-+        with patch.object(self.cmd.lookasidecache, 'remote_file_exists_head',
-+                          patch_remote_file_exists_head):
-+            self.cmd.pre_push_check("HEAD")
-

diff --git a/rpkg.spec b/rpkg.spec
index cddce34..e658f06 100644
--- a/rpkg.spec
+++ b/rpkg.spec
@@ -1,6 +1,6 @@
 Name:           rpkg
 Version:        1.69
-Release:        1%{?dist}
+Release:        2%{?dist}
 
 Summary:        Python library for interacting with rpm+git
 # Automatically converted from old format: GPLv2+ and LGPLv2 - review is highly recommended.
@@ -47,6 +47,7 @@ Patch0:         remove-koji-and-rpm-py-installer-from-requires.patch
 Patch1:         0001-Remove-Environment-Markers-syntax.patch
 %endif
 Patch2:         0002-Execute-shell-command-Non-interactive-stdin.patch
+Patch3:         0003-Use-ruff-code-checker-instead-of-bandit.patch
 
 %description
 Python library for interacting with rpm+git
@@ -277,6 +278,9 @@ example_cli_dir=$RPM_BUILD_ROOT%{_datadir}/%{name}/examples/cli
 
 
 %changelog
+* Tue Nov 25 2025 Ondřej Nosek <onosek@redhat.com> - 1.69-2
+- Patch: Use ruff code checker instead of bandit
+
 * Tue Nov 25 2025 Ondřej Nosek <onosek@redhat.com> - 1.69-1
 - Only update the progress bar when meaningfully changed (code)
 - Don’t set up upload progress when stdout isn’t a tty (code)