public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/python-urllib3] f44: Update to version 2.8.0 (close RHBZ#2534200)
@ 2026-09-19 7:28 Benjamin A. Beasley
0 siblings, 0 replies; only message in thread
From: Benjamin A. Beasley @ 2026-09-19 7:28 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/python-urllib3
Branch : f44
Commit : b108fed3eb571f9236c3fb514126403b9d50fe8d
Author : Benjamin A. Beasley <code@musicinmybrain.net>
Date : 2026-09-17T20:31:03+01:00
Stats : +15/-325 in 5 file(s)
URL : https://src.fedoraproject.org/rpms/python-urllib3/c/b108fed3eb571f9236c3fb514126403b9d50fe8d?branch=f44
Log:
Update to version 2.8.0 (close RHBZ#2534200)
---
diff --git a/5097.patch b/5097.patch
deleted file mode 100644
index ac3af0f..0000000
--- a/5097.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 8d2659ac68ec8d46dfd8c2fc0ab057b647ac7940 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Wed, 1 Jul 2026 15:05:18 +0200
-Subject: [PATCH] Deal with ssl.PROTOCOL_TLSv1 removal from Python built with
- OpenSSL 4+
-
-https://github.com/python/cpython/commit/3364e7e62fa24d0e19133fb0f90b1c24ef1110c5
-removed ssl.PROTOCOL_TLSv1 when python is built with OpenSSL 4+.
-
-We are hitting this error in Fedora (where we already updated OpenSSL):
-
- ImportError while loading conftest '/builddir/build/BUILD/python-urllib3-2.7.0-build/urllib3-2.7.0/test/conftest.py'.
- test/__init__.py:42: in <module>
- import urllib3.contrib.pyopenssl as pyopenssl
- ../BUILDROOT/usr/lib/python3.15/site-packages/urllib3/contrib/pyopenssl.py:72: in <module>
- ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,
- ^^^^^^^^^^^^^^^^^^
- E AttributeError: module 'ssl' has no attribute 'PROTOCOL_TLSv1'. Did you mean '.PROTOCOL_TLS' instead of '.PROTOCOL_TLSv1'?
-
-Used LLM to figure out what to use as a replacement protocol in tests.
-
-Assisted-By: Claude Opus 4.6
----
- changelog/5097.bugfix.rst | 2 ++
- src/urllib3/contrib/pyopenssl.py | 4 +++-
- test/test_ssl.py | 14 ++++++++------
- test/test_util.py | 24 +++++++++++++++---------
- 4 files changed, 28 insertions(+), 16 deletions(-)
- create mode 100644 changelog/5097.bugfix.rst
-
-diff --git a/changelog/5097.bugfix.rst b/changelog/5097.bugfix.rst
-new file mode 100644
-index 0000000000..73ed0ddaa1
---- /dev/null
-+++ b/changelog/5097.bugfix.rst
-@@ -0,0 +1,2 @@
-+Fixed an ``AttributeError`` on Python built with OpenSSL 4+, where
-+``ssl.PROTOCOL_TLSv1`` no longer exists.
-diff --git a/src/urllib3/contrib/pyopenssl.py b/src/urllib3/contrib/pyopenssl.py
-index 42781590ee..76a225b7bf 100644
---- a/src/urllib3/contrib/pyopenssl.py
-+++ b/src/urllib3/contrib/pyopenssl.py
-@@ -68,9 +68,11 @@ class UnsupportedExtension(Exception): # type: ignore[no-redef]
- _openssl_versions: dict[int, int] = {
- util.ssl_.PROTOCOL_TLS: OpenSSL.SSL.SSLv23_METHOD, # type: ignore[attr-defined]
- util.ssl_.PROTOCOL_TLS_CLIENT: OpenSSL.SSL.SSLv23_METHOD, # type: ignore[attr-defined]
-- ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,
- }
-
-+if hasattr(ssl, "PROTOCOL_TLSv1") and hasattr(OpenSSL.SSL, "TLSv1_METHOD"):
-+ _openssl_versions[ssl.PROTOCOL_TLSv1] = OpenSSL.SSL.TLSv1_METHOD
-+
- if hasattr(ssl, "PROTOCOL_TLSv1_1") and hasattr(OpenSSL.SSL, "TLSv1_1_METHOD"):
- _openssl_versions[ssl.PROTOCOL_TLSv1_1] = OpenSSL.SSL.TLSv1_1_METHOD
-
-diff --git a/test/test_ssl.py b/test/test_ssl.py
-index 6b1ab8589b..1e4063bf68 100644
---- a/test/test_ssl.py
-+++ b/test/test_ssl.py
-@@ -176,19 +176,21 @@ def test_create_urllib3_context_default_ciphers(
-
- context.set_ciphers.assert_not_called()
-
-+ # PROTOCOL_TLS_SERVER is used as a stand-in for any non-default ssl_version.
-+ # PROTOCOL_TLSv1/TLSv1_2 are unavailable when Python is built with OpenSSL 4+.
- @pytest.mark.parametrize(
- "kwargs",
- [
- {
-- "ssl_version": ssl.PROTOCOL_TLSv1,
-+ "ssl_version": ssl.PROTOCOL_TLS_SERVER,
- "ssl_minimum_version": ssl.TLSVersion.MINIMUM_SUPPORTED,
- },
- {
-- "ssl_version": ssl.PROTOCOL_TLSv1,
-+ "ssl_version": ssl.PROTOCOL_TLS_SERVER,
- "ssl_maximum_version": ssl.TLSVersion.TLSv1,
- },
- {
-- "ssl_version": ssl.PROTOCOL_TLSv1,
-+ "ssl_version": ssl.PROTOCOL_TLS_SERVER,
- "ssl_minimum_version": ssl.TLSVersion.MINIMUM_SUPPORTED,
- "ssl_maximum_version": ssl.TLSVersion.MAXIMUM_SUPPORTED,
- },
-@@ -229,10 +231,10 @@ def test_create_urllib3_context_ssl_version_and_ssl_min_max_version_no_warning(
- @pytest.mark.parametrize(
- "kwargs",
- [
-- {"ssl_version": ssl.PROTOCOL_TLSv1, "ssl_minimum_version": None},
-- {"ssl_version": ssl.PROTOCOL_TLSv1, "ssl_maximum_version": None},
-+ {"ssl_version": ssl.PROTOCOL_TLS_SERVER, "ssl_minimum_version": None},
-+ {"ssl_version": ssl.PROTOCOL_TLS_SERVER, "ssl_maximum_version": None},
- {
-- "ssl_version": ssl.PROTOCOL_TLSv1,
-+ "ssl_version": ssl.PROTOCOL_TLS_SERVER,
- "ssl_minimum_version": None,
- "ssl_maximum_version": None,
- },
-diff --git a/test/test_util.py b/test/test_util.py
-index 8612ab5eaf..18c65f0312 100644
---- a/test/test_util.py
-+++ b/test/test_util.py
-@@ -1216,15 +1216,21 @@ def test_resolve_cert_reqs(
- ) -> None:
- assert resolve_cert_reqs(candidate) == requirements
-
-- @pytest.mark.parametrize(
-- "candidate, version",
-- [
-- (ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1),
-- ("PROTOCOL_TLSv1", ssl.PROTOCOL_TLSv1),
-- ("TLSv1", ssl.PROTOCOL_TLSv1),
-- (ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23),
-- ],
-- )
-+ candidate_version = [
-+ (ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23),
-+ ("PROTOCOL_SSLv23", ssl.PROTOCOL_SSLv23),
-+ ("SSLv23", ssl.PROTOCOL_SSLv23),
-+ ]
-+ if hasattr(ssl, "PROTOCOL_TLSv1"):
-+ candidate_version.extend(
-+ [
-+ (ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1),
-+ ("PROTOCOL_TLSv1", ssl.PROTOCOL_TLSv1),
-+ ("TLSv1", ssl.PROTOCOL_TLSv1),
-+ ]
-+ )
-+
-+ @pytest.mark.parametrize("candidate, version", candidate_version)
- def test_resolve_ssl_version(self, candidate: int | str, version: int) -> None:
- assert resolve_ssl_version(candidate) == version
-
diff --git a/5103.patch b/5103.patch
deleted file mode 100644
index c1b28d5..0000000
--- a/5103.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 13fa1e033b37405b228599ee590af485dc3e38aa Mon Sep 17 00:00:00 2001
-From: Illia Volochii <illia.volochii@gmail.com>
-Date: Sat, 18 Jul 2026 13:25:41 +0200
-Subject: [PATCH] Replace deprecated pyOpenSSL `X509.get_subject` and
- `Context.set_passwd_cb` methods (#5103)
-
-Rebased on top of urllib3-2.7.0.
----
- src/urllib3/contrib/pyopenssl.py | 35 ++++++++++++++++++++++++++-------
- 1 file changed, 28 insertions(+), 7 deletions(-)
-
-diff --git a/src/urllib3/contrib/pyopenssl.py b/src/urllib3/contrib/pyopenssl.py
-index 76a225b7bf..a1b2c3d4e5 100644
---- a/src/urllib3/contrib/pyopenssl.py
-+++ b/src/urllib3/contrib/pyopenssl.py
-@@ -42,6 +42,8 @@
-
- import OpenSSL.SSL # type: ignore[import-not-found]
- from cryptography import x509
-+from cryptography.hazmat.primitives.serialization import load_pem_private_key
-+from cryptography.x509.oid import NameOID
-
- try:
- from cryptography.x509 import UnsupportedExtension # type: ignore[attr-defined]
-@@ -272,6 +274,15 @@
- return names
-
-
-+def _get_common_name(peer_cert: X509) -> str | None:
-+ """
-+ Given a pyOpenSSL certificate, return the subject's common name.
-+ """
-+ cert = peer_cert.to_cryptography()
-+ names = cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)
-+ return typing.cast(str, names[0].value) if names else None
-+
-+
- class WrappedSocket:
- """API-compatibility wrapper for Python OpenSSL's Connection-class."""
-
-@@ -396,7 +407,7 @@
- return OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509) # type: ignore[no-any-return]
-
- return {
-- "subject": ((("commonName", x509.get_subject().CN),),), # type: ignore[dict-item]
-+ "subject": ((("commonName", _get_common_name(x509)),),), # type: ignore[dict-item]
- "subjectAltName": get_subj_alt_name(x509),
- }
-
-@@ -482,16 +493,28 @@
- self,
- certfile: str,
- keyfile: str | None = None,
-- password: str | None = None,
-+ password: str | bytes | None = None,
- ) -> None:
- try:
- self._ctx.use_certificate_chain_file(certfile)
- if password is not None:
- if not isinstance(password, bytes):
-- password = password.encode("utf-8") # type: ignore[assignment]
-- self._ctx.set_passwd_cb(lambda *_: password)
-- self._ctx.use_privatekey_file(keyfile or certfile)
-- except OpenSSL.SSL.Error as e:
-+ password = password.encode("utf-8")
-+ # pyOpenSSL added cryptography-key support in 24.3.0.
-+ # Keep using the older password-callback path until 2026's
-+ # versions because set_passwd_cb() became deprecated in 26.3.0.
-+ if int(OpenSSL.__version__.split(".")[0]) >= 26:
-+ with open(keyfile or certfile, "rb") as key_file:
-+ private_key = load_pem_private_key(key_file.read(), password)
-+ # cryptography's loader returns a wider private-key union
-+ # than pyOpenSSL accepts, so we add `type: ignore` here.
-+ self._ctx.use_privatekey(private_key) # type: ignore[arg-type]
-+ else:
-+ self._ctx.set_passwd_cb(lambda *_: password)
-+ self._ctx.use_privatekey_file(keyfile or certfile)
-+ else:
-+ self._ctx.use_privatekey_file(keyfile or certfile)
-+ except (OpenSSL.SSL.Error, TypeError, ValueError) as e:
- raise ssl.SSLError(f"Unable to load certificate chain: {e!r}") from e
-
- def set_alpn_protocols(self, protocols: list[bytes | str]) -> None:
diff --git a/c420e267.patch b/c420e267.patch
deleted file mode 100644
index 74cf1fd..0000000
--- a/c420e267.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From c420e267acb739917bee96e021ad9a2d27de8aae Mon Sep 17 00:00:00 2001
-From: Colin Watson <cjwatson@debian.org>
-Date: Tue, 30 Jun 2026 21:48:57 +0100
-Subject: [PATCH] Fix test failures with pytest >= 9.1 (#5094)
-
-Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
----
- changelog/5094.misc.rst | 1 +
- test/test_util.py | 3 +--
- uv.lock | 6 +++---
- 3 files changed, 5 insertions(+), 5 deletions(-)
- create mode 100644 changelog/5094.misc.rst
-
-diff --git a/changelog/5094.misc.rst b/changelog/5094.misc.rst
-new file mode 100644
-index 0000000000..e6f2a24f2f
---- /dev/null
-+++ b/changelog/5094.misc.rst
-@@ -0,0 +1 @@
-+Fixed test failures with pytest >= 9.1.
-diff --git a/test/test_util.py b/test/test_util.py
-index fb8f81eb7e..8612ab5eaf 100644
---- a/test/test_util.py
-+++ b/test/test_util.py
-@@ -7,7 +7,6 @@
- import sys
- import typing
- import warnings
--from itertools import chain
- from test import ImportBlocker, ModuleStash, notBrotli, notZstd, onlyBrotli, onlyZstd
- from unittest import mock
- from unittest.mock import MagicMock, Mock, patch
-@@ -438,7 +437,7 @@ def test_percent_encoded_control_ipv6_zone_ids_raise(self, url: str) -> None:
-
- @pytest.mark.parametrize(
- "url, expected_url",
-- chain(parse_url_host_map, non_round_tripping_parse_url_host_map),
-+ [*parse_url_host_map, *non_round_tripping_parse_url_host_map],
- )
- def test_parse_url(self, url: str, expected_url: Url) -> None:
- returned_url = parse_url(url)
-diff --git a/uv.lock b/uv.lock
-index 03ec5fb75a..82d0c070eb 100644
---- a/uv.lock
-+++ b/uv.lock
-@@ -1707,7 +1707,7 @@ wheels = [
-
- [[package]]
- name = "pytest"
--version = "9.0.3"
-+version = "9.1.1"
- source = { registry = "https://pypi.org/simple" }
- dependencies = [
- { name = "colorama", marker = "sys_platform == 'win32' or (extra == 'group-7-urllib3-dev' and extra == 'group-7-urllib3-dev-min-pyopenssl') or (extra == 'group-7-urllib3-dev-min-pyopenssl' and extra == 'group-7-urllib3-mypy')" },
-@@ -1718,9 +1718,9 @@ dependencies = [
- { name = "pygments" },
- { name = "tomli", marker = "python_full_version < '3.11' or (extra == 'group-7-urllib3-dev' and extra == 'group-7-urllib3-dev-min-pyopenssl') or (extra == 'group-7-urllib3-dev-min-pyopenssl' and extra == 'group-7-urllib3-mypy')" },
- ]
--sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
-+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
- wheels = [
-- { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
-+ { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
- ]
-
- [[package]]
diff --git a/python-urllib3.spec b/python-urllib3.spec
index a2e059f..32994fe 100644
--- a/python-urllib3.spec
+++ b/python-urllib3.spec
@@ -5,7 +5,7 @@
%bcond extradeps %{undefined rhel}
Name: python-urllib3
-Version: 2.7.0
+Version: 2.8.0
Release: %autorelease
Summary: HTTP library with thread-safe connection pooling, file post, and more
@@ -31,21 +31,14 @@ Source0: %{url}/archive/%{version}/urllib3-%{version}.tar.gz
%global hypercorn_commit d1719f8c1570cbd8e6a3719ffdb14a4d72880abb
Source1: %{hypercorn_url}/archive/%{hypercorn_commit}/hypercorn-%{hypercorn_commit}.tar.gz
-# Deal with ssl.PROTOCOL_TLSv1 removal from Python built with OpenSSL 4+
-Patch: https://github.com/urllib3/urllib3/pull/5097.patch
-# Replace deprecated pyOpenSSL X509.get_subject and Context.set_passwd_cb methods
-# https://github.com/urllib3/urllib3/pull/5103 rebased
-Patch: 5103.patch
-
-# Compatibility with the latest pytest
-Patch: https://github.com/urllib3/urllib3/commit/c420e267.patch
-
BuildArch: noarch
-# The conditional is important: we benefit from tomcli for editing dependency
-# groups, but we do not want it when bootstrapping or in RHEL.
%if %{with tests}
-BuildRequires: tomcli
+# Make trustme a test dependency
+# https://github.com/urllib3/urllib3/pull/5261
+BuildRequires: %{py3_dist trustme}
+# In the “dev” dependency, not “test”; however, enables additional tests
+BuildRequires: %{py3_dist pyOpenSSL}
%endif
%global _description %{expand:
@@ -97,6 +90,13 @@ Recommends: python3-urllib3+socks
%pyproject_patch_dependency hatch-vcs:drop_upper
%pyproject_patch_dependency setuptools-scm:drop_upper
+# Not packaged, and not strictly required.
+%pyproject_patch_dependency pytest-socket:ignore
+# We have a special forked version we must use for testing instead, so we do
+# not want to generate a dependency on the system copy. Note that the system
+# copy is still an indirect dependency via quart and quart-trio.
+%pyproject_patch_dependency hypercorn:ignore
+
# Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
# RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
# (from test/test_connection.py) would fail. However, it shouldn't be to close to the build time either,
@@ -116,40 +116,12 @@ recent_date=$(date --date "7 month ago" +"%Y, %_m, %_d")
sed --in-place "s/^RECENT_DATE = datetime.date(.*)/RECENT_DATE = datetime.date($recent_date)/" \
src/urllib3/connection.py
-%if %{with tests}
-# Possible improvements to dependency groups
-# https://github.com/urllib3/urllib3/issues/3594
-# Adjust the contents of the "dev-base" dependency group by removing:
-remove_from_dev() {
- tomcli set pyproject.toml lists delitem 'dependency-groups.dev-base' "($1)\b.*"
-}
-# - Linters, coverage tools, profilers, etc.:
-# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_linters
-remove_from_dev 'coverage|pytest-memray'
-# - Dependencies for maintainer tasks
-remove_from_dev 'build|towncrier'
-# - Dependencies that are not packaged and not strictly required
-remove_from_dev 'pytest-socket'
-# - Hypercorn, because we have a special forked version we must use for
-# testing instead, so we do not want to generate a dependency on the system
-# copy. Note that the system copy is still an indirect dependency via quart
-# and quart-trio.
-remove_from_dev 'hypercorn'
-
-# Remove all version bounds for test dependencies. We must attempt to make do
-# with what we have. (This also removes any python version or platform
-# constraints, which is currently fine, but could theoretically cause trouble
-# in the future. We’ll cross that bridge if we ever arrive at it.)
-tomcli set pyproject.toml lists replace --type regex_search \
- 'dependency-groups.dev-base' '[>=]=.*' ''
-%endif
-
%generate_buildrequires
export SETUPTOOLS_SCM_PRETEND_VERSION='%{version}'
# Generate BR’s from packaged extras even when tests are disabled, to ensure
# the extras metapackages are installable if the build succeeds.
-%pyproject_buildrequires %{?with_extradeps:--extras brotli,zstd,socks,h2} %{?with_tests:--dependency-groups dev}
+%pyproject_buildrequires %{?with_extradeps:--extras brotli,zstd,socks,h2} %{?with_tests:--dependency-groups test}
%build
diff --git a/sources b/sources
index aa5132c..6a37060 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (urllib3-2.7.0.tar.gz) = 5bcfcde51cf28ab5d999ec863de9eed794df84530bdcc957259376ee8c677fe9aaee609dc643324b99c43610553914366164d99407334d8eb6ca2c60eba12f49
+SHA512 (urllib3-2.8.0.tar.gz) = cc263e675c3409a4d474b1f618669435479ea819824d1971b8583892dbf27cf2ee4ba21acf23a1762134c6e7fd35a99697e063e4625a86e0879da4cb643739cc
SHA512 (hypercorn-d1719f8c1570cbd8e6a3719ffdb14a4d72880abb.tar.gz) = 62d6787d88a2e716f0ac04fc49f6cdc586e473a660ee754ff66961922ae78bcc75d1f78b091e78557dd60f006e8e480114738c7b4ff71beac804e4fc9603240b
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-19 7:28 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-19 7:28 [rpms/python-urllib3] f44: Update to version 2.8.0 (close RHBZ#2534200) Benjamin A. Beasley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox