pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this…
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (96)
Sunpoet Po-Chuan Hsieh (sunpoet) · 9.0.2
Update to 9.0.2
Changes: https://github.com/pypa/pip/blob/master/NEWS.rst
Convert Python ports to FLAVORS.
Ports using USE_PYTHON=distutils are now flavored. They will
automatically get flavors (py27, py34, py35, py36) depending on what
versions they support.
There is also a USE_PYTHON=flavors for ports that do not use distutils
but need FLAVORS to be set. A USE_PYTHON=noflavors can be set if
using distutils but flavors are not wanted.
A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
added to cope with Python ports that did not have the Python
PKGNAMEPREFIX but are flavored.
USES=python now also exports a PY_FLAVOR variable that contains the
current python flavor. It can be used in dependency lines when the
port itself is not python flavored. For example, deskutils/calibre.
By default, all the flavors are generated. To only generate flavors
for the versions in PYTHON2_DEFAULT and PYTHON3_DEFAULT, define
BUILD_DEFAULT_PYTHON_FLAVORS in your make.conf.
In all the ports with Python dependencies, the *_DEPENDS entries MUST
end with the flavor so that the framework knows which to build/use.
This is done by appending '@${PY_FLAVOR}' after the origin (or
@${FLAVOR} if in a Python module with Python flavors, as the content
will be the same). For example:
RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}
PR: 223071
Reviewed by: portmgr, python
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D12464
devel/py-pip: Add pkg-message user WARNING
Add a pkg-message warning users not to use pip to install packages in
the system-wide Python environment location. This should have been done
a long time ago.
While I'm here:
- Add LICENSE_FILE
- Enable NO_ARCH
- Match *_DEPENDS versions to those in setup.py
- Fix incorrect pytest-xdist package name match
PR: 205881, 205819
Reported by: many
Suggested by: many
MFH: 2016Q1
Improve shebangfix framework
- Support multiple values in *_OLD_CMD, i.e. we can now fix both "/usr/bin/python" and "/usr/bin/env python" at the same time
- Default *_OLD_CMD values are now always appended, so you don't need to specify them in individual ports
- Add lua support (depends on USES=lua)
- Add more default values, such as "/usr/bin/env foo" for python, perl, bash, ruby and lua
- Shebangfix now matches whole words, e.g. we will no longer (erroneously) replace "/usr/bin/perl5.005" with "${perl_CMD}5.005" (but "/usr/bin/perl -tt" is still (correctly) replaced with "${perl_CMD} -tt")
Note that *_OLD_CMD items containing spaces must now be quoted (e.g. perl_OLD_CMD=/bin/perl /usr/bin/perl "/usr/bin/env perl")
Update shebangfix usage according to new rules in many ports:
- Remove *_OLD_CMD for patterns now replaced by default
- Quote custom *_OLD_CMD which contain spaces
Fix shebangfix usage in many ports (irrelevant to infrastructure change):
- Remove redundant SHEBANG_LANG (no need to duplicate default langs)
- Remove redundant *_CMD (such as python_CMD=${LOCALBASE}/bin/python${PYTHON_VER} when USES=python is present)
- Never use *_OLD_CMD in REINPLACE_CMD matchers, these should always look for exact string
Approved by: portmgr (bapt)
Differential Revision: D3756
Switch default python_CMD used by shebangfix to ${PYTHON_CMD} for ports using python
PR: 201077
Reviewed by: mat
With hat: portmgr
Differential Revision: https://reviews.freebsd.org/D2955
devel/py-pip: Fix pkg-plist (DOCS)
Update pkg-plist for DOCS option files that were missed in the last update
I committed.
Reported by: mat
Approved by: portmgr (blanket)
MFH: 2015Q3
devl/py-pip: Update to 7.0.3
- Update to 7.0.3
- Update pkg-plist
- USE_GITHUB to get test suite (PyPI sdist doesnt include them)
- Add TEST_DEPENDS and canonicalise regression-test: target
- Patch setup.cfg so that tests run properly
- Temporarily patch out versioned console_script's (pipX, pipX.Y)
until USE_PYTHON=concurrent supports more granularity (coming soon).
Note: A couple of tests fail because of these missing console_scripts.
- Add USE_PYTHON=concurrent support accordingly.
While I'm here:
- Makefile: Sort sections
- Makefile: Whitespace align
Changes:
https://pip.pypa.io/en/stable/news.html
PR: 200688
Approved by: nivit (maintainer)
- Update to 6.0.6 - Switch back to CHEESESHOP as download site because doc sources are now included in the distribution file - Update WWW address in pkg-descr
Relnotes: https://pip.pypa.io/en/latest/news.html
- Update to 1.5.4 - Use GitHub as download site, so we can build docs - Build docs as HTML format with Sphinx - Add a regression-test target (not active at the moment, because some tests fail) - Update pkg-descr
Release Notes: http://www.pip-installer.org/en/latest/news.html
pip is a replacement for easy_install. It uses mostly the same techniques for finding packages, so packages that were made easy_installable should be pip-installable as well.
pip is meant to improve on easy_install. Some of the improvements:
* All packages are downloaded before installation. Partially-completed
installation doesn't occur as a result.
* Care is taken to present useful output on the console.
* The reasons for actions are kept track of. For instance, if a package
is being installed, pip keeps track of why that package was required.
* Error messages should be useful.
* Packages don't have to be installed as egg archives, they can be
installed flat (while keeping the egg metadata).
WWW: http://pip.openplans.org/