GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — bpo-46985: Upgrade bundled pip to 22.0.4 by pradyunsg · Pull Request #31819 · python/cpython

Conversation

pradyunsg commented Mar 11, 2022 •

edited by bedevere-bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

~/Developer/OSS/cpython
❯ sha256sum ./Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl 
c6aca0f2f081363f689f041d90dab2a07a9a07fb840284db2218117a52da800b  ./Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl

That matches the hash on PyPI: https://pypi.org/project/pip/#copy-hash-modal-3c7d56c4-b870-46df-b7ea-70d95882728f

https://bugs.python.org/issue46985

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

pradyunsg added 2 commits

March 11, 2022 13:32


          bpo-46985: Upgrade bundled pip to 22.0.4

b47333d


          📰

e1dbf7b

bedevere-bot added the awaiting review label

Mar 11, 2022

the-knights-who-say-ni added the CLA signed label

Mar 11, 2022

pradyunsg commented Mar 11, 2022

Copy link

Copy Markdown

Member Author

If someone wants to validate the file I've added here, you can download it directly from GitHub ¹ and verify that the hash matches what's on PyPI. Or... You can trust that I'm not trying to inject malicious code into CPython. :)

Footnotes

https://github.com/python/cpython/raw/e1dbf7bf8190f9f7f839ad8cc288a3063eaa942c/Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl ↩

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pradyunsg mentioned this pull request

Mar 11, 2022

bpo-46986: Upgrade bundled setuptools to 60.9.3 #31820

Merged

uranusjr approved these changes

Mar 12, 2022

View reviewed changes

uranusjr left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also looking forward to backporting this to 3.9 to quelch a warning on distutils/sysconfig behaviour mismatch.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

bedevere-bot added awaiting core review and removed awaiting review labels

Mar 12, 2022

pradyunsg commented Mar 12, 2022 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member Author

IIUC, we should probably backport this all the way down to 3.7.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

uranusjr commented Mar 12, 2022

Copy link

Copy Markdown

Contributor

I’m not sure what the backporting strategy is, but only 3.9 and 3.10 are showing the distutils warning from ensurepip right now, so that’s what I care most.

pradyunsg reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

FFY00 approved these changes

Mar 12, 2022

View reviewed changes

FFY00 requested a review from jaraco

March 12, 2022 18:54

JelleZijlstra added needs backport to 3.9 labels

Mar 13, 2022

JelleZijlstra commented Mar 13, 2022

Copy link

Copy Markdown

Member

Seems like we haven't upgraded the bundled pip/setuptools on the security fix branches in the past (e.g. #25576).

pradyunsg reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pradyunsg commented Mar 13, 2022

Copy link

Copy Markdown

Member Author

Alrighty, then backporting down to 3.9 it is! :)

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

ned-deily added needs backport to 3.7 labels

Mar 13, 2022

ned-deily commented Mar 13, 2022

Copy link

Copy Markdown

Member

There appear to be a couple of security issues that have been fixed in some of the vendored packages within the pip wheel (for example, CVE-2021-33503 in urllib3) since the 3.8 and 3.7 branches were last updated so I think it would be better to backport to them. I'll defer to @ambv for 3.8 but 3.7 is even older.

JelleZijlstra and pradyunsg reacted with thumbs up emoji

All reactions

👍 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

ned-deily merged commit d87f1b7 into python:main

Mar 13, 2022

miss-islington commented Mar 13, 2022

Copy link

Copy Markdown

Contributor

Thanks @pradyunsg for the PR, and @ned-deily for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9, 3.10.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot removed awaiting core review needs backport to 3.10 labels

Mar 13, 2022

bedevere-bot commented Mar 13, 2022

Copy link

Copy Markdown

GH-31849 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington commented Mar 13, 2022

Copy link

Copy Markdown

Contributor

Sorry, @pradyunsg and @ned-deily, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker d87f1b787ed38dfd307d82452f2efe9dc5b93942 3.8

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Mar 13, 2022


          bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

34a5939

(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>

miss-islington assigned ned-deily

Mar 13, 2022

miss-islington commented Mar 13, 2022

Copy link

Copy Markdown

Contributor

Sorry @pradyunsg and @ned-deily, I had trouble checking out the 3.7 backport branch.
Please backport using cherry_picker on command line.
cherry_picker d87f1b787ed38dfd307d82452f2efe9dc5b93942 3.7

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot removed the needs backport to 3.9 label

Mar 13, 2022

bedevere-bot commented Mar 13, 2022

Copy link

Copy Markdown

GH-31850 is a backport of this pull request to the 3.9 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Mar 13, 2022


          bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

76c41e5

(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>

bedevere-bot commented Mar 13, 2022

Copy link

Copy Markdown

GH-31851 is a backport of this pull request to the 3.8 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot removed the needs backport to 3.8 label

Mar 13, 2022

bedevere-bot commented Mar 13, 2022

Copy link

Copy Markdown

GH-31852 is a backport of this pull request to the 3.7 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot removed the needs backport to 3.7 label

Mar 13, 2022

miss-islington added a commit that referenced this pull request

Mar 13, 2022


          [3.10] bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31849)

1ceda97

(cherry picked from commit d87f1b7)


Co-authored-by: Pradyun Gedam <[email protected]>

Automerge-Triggered-By: GH:ned-deily

miss-islington added a commit that referenced this pull request

Mar 13, 2022


          [3.9] bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31850)

4f340b0

(cherry picked from commit d87f1b7)


Co-authored-by: Pradyun Gedam <[email protected]>

Automerge-Triggered-By: GH:ned-deily

ned-deily pushed a commit to ned-deily/cpython that referenced this pull request

Mar 13, 2022


          bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

ce76409

(cherry picked from commit d87f1b7)

ned-deily added a commit that referenced this pull request

Mar 13, 2022


          bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31852)

5a8e968

(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>

pradyunsg deleted the pip-22-0-upgrade branch

March 14, 2022 07:28

carljm pushed a commit to carljm/cpython that referenced this pull request

Mar 14, 2022


          Merge branch 'main' into dictwatch

d22463b

* main: (94 commits)
  Revert "bpo-46986: Upgrade bundled setuptools to 60.9.3 (pythonGH-31820)" (pythonGH-31879)
  bpo-30677: [doc] mention that os.mkdir() can raise FileNotFoundError (pythonGH-31548)
  git ignore Lib/site-packages (pythonGH-31862)
  bpo-31415: importtime was made by Inada Naoki (pythonGH-31875)
  bpo-46920: Remove code that has explainers why it was disabled (pythonGH-31813)
  bpo-46920: Remove disabled debug code added decades ago and likely unnecessary (pythonGH-31812)
  bpo-46920: Remove code that has no explainer why it was disabled (pythonGH-31814)
  bpo-46906: Mention native endian in PyFloat_Pack8() doc (pythonGH-31866)
  bpo-40280: select: Use NULL for empty fdset (pythonGH-31865)
  CI: Fix patchcheck (pythonGH-31708)
  bpo-46987: Remove _PySys_GetObjectId / _PySys_GetObjectId (pythonGH-31835)
  bpo-46994: Accept explicit contextvars.Context in asyncio create_task() API (pythonGH-31837)
  bpo-39829: Fix `__len__()` is called twice in list() constructor (pythonGH-31816)
  bpo-47003: Cleanup _overlapped module (pythonGH-31848)
  bpo-47004: Sync with importlib_metadata 4.11.3. (python#31854)
  bpo-46986: Upgrade bundled setuptools to 60.9.3 (pythonGH-31820)
  bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)
  bpo-46805: Add low level UDP socket functions to asyncio (pythonGH-31455)
  bpo-46995: Deprecate missing asyncio.Task.set_name() for third-party task implementations (pythonGH-31838)
  bpo-43215: Document Happy Eyeballs args of asyncio.open_connection (pythonGH-24525)
  ...

ambv pushed a commit that referenced this pull request

Mar 15, 2022


          bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31851)

7a315d8

(cherry picked from commit d87f1b7)

Co-authored-by: Pradyun Gedam <[email protected]>

hello-adam pushed a commit to hello-adam/cpython that referenced this pull request

Jun 2, 2022


          [3.9] bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819) (pyth…

7c36941

…onGH-31850)

(cherry picked from commit d87f1b7)


Co-authored-by: Pradyun Gedam <[email protected]>

Automerge-Triggered-By: GH:ned-deily

illia-v mentioned this pull request

Jun 21, 2022

gh-91172: Create a workflow for verifying bundled pip and setuptools #31885

Merged

Reviewers

FFY00

FFY00 approved these changes

jaraco

Awaiting requested review from jaraco

+1 more reviewer

uranusjr

uranusjr approved these changes

Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

ned-deily

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

8 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

pradyunsg commented Mar 11, 2022 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pradyunsg commented Mar 11, 2022

Footnotes

Uh oh!

uranusjr left a comment

Choose a reason for hiding this comment

Uh oh!

pradyunsg commented Mar 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

uranusjr commented Mar 12, 2022

Uh oh!

JelleZijlstra commented Mar 13, 2022

Uh oh!

pradyunsg commented Mar 13, 2022

Uh oh!

ned-deily commented Mar 13, 2022

Uh oh!

miss-islington commented Mar 13, 2022

Uh oh!

bedevere-bot commented Mar 13, 2022

Uh oh!

miss-islington commented Mar 13, 2022

Uh oh!

miss-islington commented Mar 13, 2022

Uh oh!

bedevere-bot commented Mar 13, 2022

Uh oh!

bedevere-bot commented Mar 13, 2022

Uh oh!

bedevere-bot commented Mar 13, 2022

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

pradyunsg commented Mar 11, 2022 •

edited by bedevere-bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

pradyunsg commented Mar 12, 2022 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.