Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-46985: Upgrade bundled pip to 22.0.4 #31819

Merged
merged 2 commits into from
Mar 13, 2022
Merged

bpo-46985: Upgrade bundled pip to 22.0.4 #31819

merged 2 commits into from
Mar 13, 2022

Conversation

pradyunsg
Copy link
Member

@pradyunsg pradyunsg commented Mar 11, 2022 •
edited by bedevere-bot
Loading 

~/Developer/OSS/cpython
❯ sha256sum ./Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl 
c6aca0f2f081363f689f041d90dab2a07a9a07fb840284db2218117a52da800b  ./Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl

That matches the hash on PyPI: https://pypi.org/project/pip/#copy-hash-modal-3c7d56c4-b870-46df-b7ea-70d95882728f

https://bugs.python.org/issue46985

@pradyunsg
Copy link
Member Author

If someone wants to validate the file I've added here, you can download it directly from GitHub 1 and verify that the hash matches what's on PyPI. Or... You can trust that I'm not trying to inject malicious code into CPython. :)

Footnotes

  1. https://github.com/python/cpython/raw/e1dbf7bf8190f9f7f839ad8cc288a3063eaa942c/Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl ↩

@pradyunsg pradyunsg mentioned this pull request Mar 11, 2022
Merged
uranusjr
uranusjr approved these changes Mar 12, 2022
View reviewed changes
Copy link
Contributor

@uranusjr uranusjr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also looking forward to backporting this to 3.9 to quelch a warning on distutils/sysconfig behaviour mismatch.

@pradyunsg
Copy link
Member Author

pradyunsg commented Mar 12, 2022 •
edited
Loading

IIUC, we should probably backport this all the way down to 3.7.

@uranusjr
Copy link
Contributor

I’m not sure what the backporting strategy is, but only 3.9 and 3.10 are showing the distutils warning from ensurepip right now, so that’s what I care most.

@FFY00 FFY00 requested a review from jaraco March 12, 2022 18:54
@JelleZijlstra JelleZijlstra added needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes labels Mar 13, 2022
@JelleZijlstra
Copy link
Member

Seems like we haven't upgraded the bundled pip/setuptools on the security fix branches in the past (e.g. #25576).

@pradyunsg
Copy link
Member Author

Alrighty, then backporting down to 3.9 it is! :)

@ned-deily
Copy link
Member

There appear to be a couple of security issues that have been fixed in some of the vendored packages within the pip wheel (for example, CVE-2021-33503 in urllib3) since the 3.8 and 3.7 branches were last updated so I think it would be better to backport to them. I'll defer to @ambv for 3.8 but 3.7 is even older.

@ned-deily ned-deily merged commit d87f1b7 into python:main Mar 13, 2022
@miss-islington
Copy link
Contributor

Thanks @pradyunsg for the PR, and @ned-deily for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9, 3.10.
🐍🍒⛏🤖

@bedevere-bot
Copy link

GH-31849 is a backport of this pull request to the 3.10 branch.

@miss-islington
Copy link
Contributor

Sorry, @pradyunsg and @ned-deily, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker d87f1b787ed38dfd307d82452f2efe9dc5b93942 3.8

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 13, 2022
@pradyunsg @miss-islington
bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)
34a5939 
(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>
@miss-islington
Copy link
Contributor

Sorry @pradyunsg and @ned-deily, I had trouble checking out the 3.7 backport branch.
Please backport using cherry_picker on command line.
cherry_picker d87f1b787ed38dfd307d82452f2efe9dc5b93942 3.7

@bedevere-bot bedevere-bot removed the needs backport to 3.9 only security fixes label Mar 13, 2022
@bedevere-bot
Copy link

GH-31850 is a backport of this pull request to the 3.9 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 13, 2022
@pradyunsg @miss-islington
bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)
76c41e5 
(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>
@bedevere-bot
Copy link

GH-31851 is a backport of this pull request to the 3.8 branch.

@bedevere-bot
Copy link

GH-31852 is a backport of this pull request to the 3.7 branch.

miss-islington added a commit that referenced this pull request Mar 13, 2022
@miss-islington
[3.10] bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31849)
1ceda97 
(cherry picked from commit d87f1b7)


Co-authored-by: Pradyun Gedam <[email protected]>

Automerge-Triggered-By: GH:ned-deily
miss-islington added a commit that referenced this pull request Mar 13, 2022
@miss-islington
[3.9] bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31850)
4f340b0 
(cherry picked from commit d87f1b7)


Co-authored-by: Pradyun Gedam <[email protected]>

Automerge-Triggered-By: GH:ned-deily
ned-deily pushed a commit to ned-deily/cpython that referenced this pull request Mar 13, 2022
@pradyunsg @ned-deily
bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)
ce76409 
(cherry picked from commit d87f1b7)
ned-deily added a commit that referenced this pull request Mar 13, 2022
@ned-deily @pradyunsg
bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31852)
5a8e968 
(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>
@pradyunsg pradyunsg deleted the pip-22-0-upgrade branch March 14, 2022 07:28
carljm pushed a commit to carljm/cpython that referenced this pull request Mar 14, 2022
Merge branch 'main' into dictwatch
d22463b 
* main: (94 commits)
  Revert "bpo-46986: Upgrade bundled setuptools to 60.9.3 (pythonGH-31820)" (pythonGH-31879)
  bpo-30677: [doc] mention that os.mkdir() can raise FileNotFoundError (pythonGH-31548)
  git ignore Lib/site-packages (pythonGH-31862)
  bpo-31415: importtime was made by Inada Naoki (pythonGH-31875)
  bpo-46920: Remove code that has explainers why it was disabled (pythonGH-31813)
  bpo-46920: Remove disabled debug code added decades ago and likely unnecessary (pythonGH-31812)
  bpo-46920: Remove code that has no explainer why it was disabled (pythonGH-31814)
  bpo-46906: Mention native endian in PyFloat_Pack8() doc (pythonGH-31866)
  bpo-40280: select: Use NULL for empty fdset (pythonGH-31865)
  CI: Fix patchcheck (pythonGH-31708)
  bpo-46987: Remove _PySys_GetObjectId / _PySys_GetObjectId (pythonGH-31835)
  bpo-46994: Accept explicit contextvars.Context in asyncio create_task() API (pythonGH-31837)
  bpo-39829: Fix `__len__()` is called twice in list() constructor (pythonGH-31816)
  bpo-47003: Cleanup _overlapped module (pythonGH-31848)
  bpo-47004: Sync with importlib_metadata 4.11.3. (python#31854)
  bpo-46986: Upgrade bundled setuptools to 60.9.3 (pythonGH-31820)
  bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)
  bpo-46805: Add low level UDP socket functions to asyncio (pythonGH-31455)
  bpo-46995: Deprecate missing asyncio.Task.set_name() for third-party task implementations (pythonGH-31838)
  bpo-43215: Document Happy Eyeballs args of asyncio.open_connection (pythonGH-24525)
  ...
ambv pushed a commit that referenced this pull request Mar 15, 2022
@ned-deily @pradyunsg
bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31851)
7a315d8 
(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>
hello-adam pushed a commit to hello-adam/cpython that referenced this pull request Jun 2, 2022
@miss-islington @hello-adam
[3.9] bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819) (pyth…
7c36941 
…onGH-31850)

(cherry picked from commit d87f1b7)


Co-authored-by: Pradyun Gedam <[email protected]>

Automerge-Triggered-By: GH:ned-deily
@illia-v illia-v mentioned this pull request Jun 21, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@uranusjr uranusjr uranusjr approved these changes

@FFY00 FFY00 FFY00 approved these changes

@jaraco jaraco Awaiting requested review from jaraco

Assignees

@ned-deily ned-deily

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@pradyunsg @uranusjr @JelleZijlstra @ned-deily @miss-islington @bedevere-bot @FFY00 @the-knights-who-say-ni