#28 F39: Update to 9.2.1 (close RHBZ#2273352, fix CVE-2024-27982)
Merged a month ago by music. Opened a month ago by music.

file modified
+4
@@ -22,3 +22,7 @@ 

  /llhttp-9.1.2-nm-dev.tgz

  /llhttp-9.1.3.tar.gz

  /llhttp-9.1.3-nm-dev.tgz

+ /llhttp-9.2.0.tar.gz

+ /llhttp-9.2.0-nm-dev.tar.xz

+ /llhttp-9.2.1.tar.gz

+ /llhttp-9.2.1-nm-dev.tar.zst

@@ -12,6 +12,19 @@ 

  # tslib/test/validateModuleExportsMatchCommonJS

  validateModuleExportsMatchCommonJS = "<unknown version>"

  

+ # Similarly, these are all just ES6 module (mjs) or CommonJS (cjs) module

+ # wrappers in packages that do have proper license information:

+ # node_modules_dev/@ungap/structured-clone/cjs

+ # node_modules_dev/@typescript-eslint/utils/node_modules/minimatch/dist/cjs

+ # node_modules_dev/@typescript-eslint/utils/node_modules/minimatch/dist/mjs

+ # node_modules_dev/@typescript-eslint/parser/node_modules/minimatch/dist/cjs

+ # node_modules_dev/@typescript-eslint/parser/node_modules/minimatch/dist/mjs

+ # node_modules_dev/@typescript-eslint/type-utils/node_modules/minimatch/dist/cjs

+ # node_modules_dev/@typescript-eslint/type-utils/node_modules/minimatch/dist/mjs

+ # node_modules_dev/flatted/cjs

+ cjs = "<unknown version>"

+ mjs = "<unknown version>"

+ 

  # These are all “dummy” modules in the tests for resolve:

  # resolve/test/module_dir/zmodules/bbb

  bbb = "<unknown version>"

file modified
+4 -16
@@ -21,9 +21,7 @@ 

              continue  # Do not even check the license

          elif license is None:

              problem = True

-             print(

-                 f"Missing license in package.json for {identity}", file=stderr

-             )

+             print(f"Missing license in package.json for {identity}", file=stderr)

          elif isinstance(license, dict):

              if isinstance(license.get("type"), str):

                  continue
@@ -62,10 +60,6 @@ 

          return "At least one missing license was found."

  

  

- def check_exception(exceptions, name, version):

-     x = args.exceptions

- 

- 

  def parse(package_json_path):

      with package_json_path.open("rb") as pjfile:

          pj = json.load(pjfile)
@@ -85,9 +79,7 @@ 

  def parse_args():

      parser = ArgumentParser(

          formatter_class=RawDescriptionHelpFormatter,

-         description=(

-             "Search for bundled dependencies without declared licenses"

-         ),

+         description=("Search for bundled dependencies without declared licenses"),

          epilog="""

  

  The exceptions file must be a TOML file with zero or more tables. Each table’s
@@ -154,9 +146,7 @@ 

              parser.error(f"Invalid format in {xname}: not an object")

          for tablename, table in args.exceptions.items():

              if not isinstance(table, dict):

-                 parser.error(

-                     f"Non-table entry in {xname}: {tablename} = {table!r}"

-                 )

+                 parser.error(f"Non-table entry in {xname}: {tablename} = {table!r}")

              overlay = {}

              for key, value in table.items():

                  if isinstance(value, str):
@@ -176,9 +166,7 @@ 

              x.update(args.exceptions[add])

          except KeyError:

              if xname is None:

-                 parser.error(

-                     f"No table {add}, as no exceptions file was given"

-                 )

+                 parser.error(f"No table {add}, as no exceptions file was given")

              else:

                  parser.error(f"No table {add} in {xname}")

      # Store the merged dictionary

file modified
+3 -2
@@ -97,12 +97,13 @@ 

  

  if [[ -d node_modules_prod ]]

  then

-   tar -czf "../llhttp-${VERSION}-nm-prod.tgz" node_modules_prod

+   tar -cf "../llhttp-${VERSION}-nm-prod.tar" node_modules_prod

  fi

  if [[ -d node_modules_dev ]]

  then

-   tar -czf "../llhttp-${VERSION}-nm-dev.tgz" node_modules_dev

+   tar -cf "../llhttp-${VERSION}-nm-dev.tar" node_modules_dev

  fi

+ zstdmt --ultra -22 "../llhttp-${VERSION}-nm-prod.tar" "../llhttp-${VERSION}-nm-dev.tar"

  

  cd ..

  find . -mindepth 1 -maxdepth 1 -type f \( -name "$(basename "${ARCHIVE}")" \

file added
+9
@@ -0,0 +1,9 @@ 

+ # These are not real spelling errors...

+ addFilter(r" spelling-error \('(llparse|js)', ")

+ addFilter(r" spelling-error \(\"embedder's\", ")

+ # All of the documentation is in the -devel subpackage.

+ addFilter(r"llhttp\..*: no-documentation")

+ # This Source cannot be a URL because it is generated by the bundling script.

+ addFilter(r" invalid-url Source[0-9]+: llhttp-.*-nm-dev\.tar\.zst$")

+ # Bogus; it is a perfectly fine zstandard file.

+ addFilter(r" inconsistent-file-extension llhttp-.*-nm-dev\.tar\.zst$")

file modified
+79 -8
@@ -26,8 +26,8 @@ 

  # additional source even if we do not do the re-generation ourselves.

  

  Name:           llhttp

- Version:        9.1.3

- %global so_version 9.1

+ Version:        9.2.1

+ %global so_version 9.2

  Release:        %autorelease

  Summary:        Port of http_parser to llparse

  
@@ -46,7 +46,7 @@ 

  #   therefore, no bundled licenses text file is generated either

  Source1:        llhttp-packaging-bundler

  # Created with llhttp-packaging-bundler (Source1):

- Source2:        llhttp-%{version}-nm-dev.tgz

+ Source2:        llhttp-%{version}-nm-dev.tar.zst

  

  # While nothing in the dev bundle is installed, we still choose to audit for

  # null licenses at build time and to keep manually-approved exceptions in a
@@ -71,6 +71,11 @@ 

  

  # For check-null-licenses

  BuildRequires:  python3-devel

+ %if !0%{?rhel}

+ # For additional license auditing:

+ BuildRequires:  askalono-cli

+ BuildRequires:  licensecheck

+ %endif

  

  %description

  This project is a port of http_parser to TypeScript. llparse is used to
@@ -102,7 +107,7 @@ 

  

  # Set up bundled (dev) node modules required to generate the C sources from the

  # TypeScript sources.

- tar -xzf '%{SOURCE2}'

+ tar --zstd --extract --file='%{SOURCE2}'

  mkdir -p node_modules

  pushd node_modules

  ln -s ../node_modules_dev/* .
@@ -146,6 +151,74 @@ 

  # code with license problems in the source RPM.

  %{python3} '%{SOURCE3}' --exceptions '%{SOURCE4}' --with dev node_modules_dev

  

+ %if !0%{?rhel}

+ # Ensure we have checked all of the licenses in the dev dependency bundle for

+ # allowability.

+ pattern="${pattern-}${pattern+|}UNKNOWN|(Apache|Python) License 2\\.0"

+ pattern="${pattern-}${pattern+|}(MIT|ISC|BSD [023]-Clause) License"

+ pattern="${pattern-}${pattern+|}BSD 2-Clause with views sentence"

+ pattern="${pattern-}${pattern+|}MIT License and/or X11 License"

+ pattern="${pattern-}${pattern+|}GNU General Public License"

+ # The CC0-1.0 license is *not allowed* in Fedora for code, but the

+ # binary-search dev dependency falls under the following blanket exception:

+ #

+ #   Existing uses of CC0-1.0 on code files in Fedora packages prior to

+ #   2022-08-01, and subsequent upstream versions of those files in those

+ #   packages, continue to be allowed. We encourage Fedora package maintainers

+ #   to ask upstreams to relicense such files.

+ #

+ # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/91#note_1151947383

+ #

+ # This can be verified by checking out commit

+ # f460573ec4dc41968e600a96aaaf03a167b236bf (2021-12-16) from dist-git for this

+ # package, obtaining the source llhttp-6.0.6-nm-dev.tgz, and observing that

+ # llhttp-6.0.6/node_modules_dev/binary-search/package.json shows the CC0-1.0

+ # license.

+ pattern="${pattern-}${pattern+|}binary-search/package.json: (\*No copyright\* )?Creative Commons CC0 1\.0"

+ # The license BSD-3-Clause-Clear appears in sprintf-js/bower.json. This license

+ # is on the not-allowed list, but it is not real: sprintf-js/package.json and

+ # sprintf-js/LICENSE have the correct (and allowed) BSD-3-Clause license, and

+ # upstream confirmed in “Licensing Question”

+ # https://github.com/alexei/sprintf.js/issues/211 that the appearance of

+ # BSD-3-Clause-Clear in this file was a mere typo.

+ pattern="${pattern-}${pattern+|}sprintf-js/bower.json: (\*No copyright\* )?BSD 3-Clause Clear License"

+ 

+ if licensecheck -r node_modules_dev |

+     grep -vE "(${pattern})( \\[generated file\\])?\$" ||

+   ! askalono crawl node_modules_dev | awk '

+       $1 == "License:" { license = $0; next }

+       $1 == "Score:" {

+         if ( \

+           license ~ /: (MIT|ISC) \(/ || \

+           license ~ /: (0BSD|BSD-2-Clause(-Views)?|BSD-3-Clause) \(/ || \

+           license ~ /: (Apache-2\.0|Python-2\.0\.1) \(/ \

+         ) {

+           next # license is OK

+         }

+         # license needs auditing

+         problem = 1

+         print file; print license; print $0

+         next

+       }

+       { file = $0 }

+       END { exit problem }'

+ 

+ then

+   cat 1>&2 <<'EOF'

+ =================================================================

+ Possible new license(s) found in dev dependency bundle!

+ 

+ While these do not contribute to License, they must appear in:

+ https://docs.fedoraproject.org/en-US/legal/allowed-licenses/

+ 

+ Please audit them and modify the patterns representing expected

+ licenses in the spec file!

+ =================================================================

+ EOF

+   exit 1

+ fi

+ %endif

+ 

  # http-loose-request.c:7205:20: error: invalid conversion from 'void*' to

  #     'const unsigned char*' [-fpermissive]

  #  7205 |     start = state->_span_pos0;
@@ -155,10 +228,8 @@ 

  export CXXFLAGS="${CXXFLAGS-} -fpermissive"

  export CFLAGS="${CFLAGS-} -fpermissive"

  export CLANG=gcc

- # See scripts.mocha in package.json:

- NODE_ENV=test ./node_modules/.bin/mocha \

-     -r ts-node/register/type-check \

-     test/*-test.ts

+ # See scripts.test in package.json:

+ NODE_ENV=test node -r ts-node/register/type-check ./test/md-test.ts

  

  

  %files

file modified
+2 -2
@@ -1,2 +1,2 @@ 

- SHA512 (llhttp-9.1.3.tar.gz) = 037d873eda6b27cb7ef4cbb805ec1172a76dc3ba19f8ca868029ecc2a88129f8c8de3803ce91f6a6c7a995f56ab8267f1001c93009272c34a2350160446153fa

- SHA512 (llhttp-9.1.3-nm-dev.tgz) = 257ef03ba5a60e4338a6cc637829f29e98f6d2965aa206560b07f54b31d461f8eb1d41917bf7ad2538933aa9a90c12e0a663c366b62008ee263cd775a77a7dba

+ SHA512 (llhttp-9.2.1.tar.gz) = 653a0d65226644a7d71c538da343b2cff75bc7acc8cd6473ac19d166cc77c3e00c6a9087120d9abb63a9ac6b50e408c905d5925fa96d5d46d425ee7d0e3cdf9c

+ SHA512 (llhttp-9.2.1-nm-dev.tar.zst) = 07cd54cdb0fd72388359a1ca132fdddd3e46ce4a5607b46fe6fd8c9422f17f7cdb8cd32893b3d75884d4c2934befeb1e3a50a18e6c11ccc4c2d872b25eed9875

Merge Rawhide back to F39.

Since 9.2.0 broke ABI from 9.1.3, dependent packages will need to be rebuilt in a side tag. Also, aiohttp support for llhttp 9.2.1 will need to be backported as in https://src.fedoraproject.org/rpms/python-aiohttp/pull-request/32.

This package has a permanent FESCo exception for incompatible upgrades.

Build succeeded.
https://fedora.softwarefactory-project.io/zuul/buildset/8e345c7822f34a9aa357b5020c07673d

Pull-Request has been merged by music

a month ago