From aa79f5a600a7175c1eb97f90b5b2476aeeb05fd5 Mon Sep 17 00:00:00 2001 From: Chris Mayo Date: Mon, 5 Dec 2022 19:22:35 +0000 Subject: [PATCH 1/4] Increase minimum Requests version to 2.20 2.20 fixes CVE-2018-18074. --- pyproject.toml | 2 +- requirements-min.txt | 2 +- requirements.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 41d22d40..c4be6685 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -21,7 +21,7 @@ classifiers = [ requires-python = ">=3.7" dependencies = [ - "requests >= 2.19", + "requests >= 2.20", "dnspython >= 2.0", "beautifulsoup4 >= 4.8.1", ] diff --git a/requirements-min.txt b/requirements-min.txt index b2b2f144..c46475b6 100644 --- a/requirements-min.txt +++ b/requirements-min.txt @@ -1,6 +1,6 @@ # required: beautifulsoup4 == 4.8.1 -requests == 2.19.0 +requests == 2.20.0 dnspython == 2.0.0 # optional: argcomplete == 1.8.1 diff --git a/requirements.txt b/requirements.txt index c12f5530..9e70249d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,6 +1,6 @@ # required: beautifulsoup4 >= 4.8.1 -requests >= 2.19 +requests >= 2.20 dnspython >= 2.0 # optional: argcomplete >= 1.8.1 From 44226ed7b81d8424a945ccbfa248cb979acdf003 Mon Sep 17 00:00:00 2001 From: Chris Mayo Date: Mon, 5 Dec 2022 19:22:35 +0000 Subject: [PATCH 2/4] Document installing pdfminer.six --- doc/install.txt | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/doc/install.txt b/doc/install.txt index f4d65071..02577b3f 100644 --- a/doc/install.txt +++ b/doc/install.txt @@ -104,10 +104,13 @@ First, install the required software. 8. *Optional, for displaying country codes:* GeoIP from https://pypi.org/project/GeoIP/ -9. *Optional, used for Virus checking:* +9. *Optional, for reading PDF files:* + pdfminer.six from https://pypi.org/project/pdfminer.six/ + +10. *Optional, used for Virus checking:* ClamAv from https://www.clamav.net/ -10. *Optional, to run the WSGI web interface:* +11. *Optional, to run the WSGI web interface:* Apache from https://httpd.apache.org/ mod_wsgi from https://pypi.org/project/mod-wsgi/ From 46c5712baff479de2a8cc010798712cae8c53ca1 Mon Sep 17 00:00:00 2001 From: Chris Mayo Date: Mon, 5 Dec 2022 19:22:35 +0000 Subject: [PATCH 3/4] Add pdfminer.six to minimum version testing 20181108 is the version used by the current Debian oldstable. Ubuntu 20.04 LTS has 20191020. pdfminer installs cryptography, >= 38 breaks pyOpenSSL < 22 as found in Ubuntu 20.04 LTS. Update docs job to use ubuntu-22.04 to avoid failures. --- .github/workflows/build.yml | 2 +- requirements-min.txt | 1 + requirements.txt | 1 + tox.ini | 1 - 4 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index dd453758..f8a22da3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -84,7 +84,7 @@ jobs: # there's some overlap with publish-pages.yml, but this one runs on pull # requests, doesn't publish, and runs more doc checks name: docs - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 steps: - name: Git clone diff --git a/requirements-min.txt b/requirements-min.txt index c46475b6..5cf3e824 100644 --- a/requirements-min.txt +++ b/requirements-min.txt @@ -4,3 +4,4 @@ requests == 2.20.0 dnspython == 2.0.0 # optional: argcomplete == 1.8.1 +pdfminer.six == 20181108 diff --git a/requirements.txt b/requirements.txt index 9e70249d..c869cc03 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,3 +4,4 @@ requests >= 2.20 dnspython >= 2.0 # optional: argcomplete >= 1.8.1 +pdfminer.six >= 20181108 diff --git a/tox.ini b/tox.ini index c4a414a9..eff1a51c 100644 --- a/tox.ini +++ b/tox.ini @@ -5,7 +5,6 @@ envlist = py3{7,8,9,10,11}, minreqs deps = pyftpdlib parameterized - pdfminer.six pyopenssl pytest-xdist pytest-cov From bf965c6a1aa5815a0e370db4e36232f2f602a5c9 Mon Sep 17 00:00:00 2001 From: Chris Mayo Date: Mon, 5 Dec 2022 19:22:35 +0000 Subject: [PATCH 4/4] Tidy manual setup install steps --- doc/install.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/install.txt b/doc/install.txt index 02577b3f..dfb62d30 100644 --- a/doc/install.txt +++ b/doc/install.txt @@ -96,16 +96,16 @@ First, install the required software. 5. Python dnspython package from https://pypi.org/project/dnspython/ 6. *Optional, build time only, for translations:* - polib Python module from https://pypi.org/project/polib/ + Python polib package from https://pypi.org/project/polib/ 7. *Optional, for bash-completion:* - argcomplete Python module from https://pypi.org/project/argcomplete/ + Python argcomplete package from https://pypi.org/project/argcomplete/ 8. *Optional, for displaying country codes:* - GeoIP from https://pypi.org/project/GeoIP/ + Python GeoIP package from https://pypi.org/project/GeoIP/ 9. *Optional, for reading PDF files:* - pdfminer.six from https://pypi.org/project/pdfminer.six/ + Python pdfminer.six package from https://pypi.org/project/pdfminer.six/ 10. *Optional, used for Virus checking:* ClamAv from https://www.clamav.net/