netplan: fix CVE-2022-4968 (#10945)

Author: SeanDougherty

SPECS/netplan/disable-broken-tests.patch

@@ -1,9 +1,20 @@
+From 727a90437e38e70a9ab8d160fa46fc022a79e577 Mon Sep 17 00:00:00 2001
+From: Sean Dougherty <sdougherty@microsoft.com>
+Date: Tue, 5 Nov 2024 22:41:09 +0000
+Subject: [PATCH] Temporarily disabling broken test suite due to version
+ mismatches between pytest-cov and python3-coverage in 3.0. Originally added
+ by Francisco Huelsz Prince.
+
+---
+ meson.build | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
 diff --git a/meson.build b/meson.build
-index 66cda8b..5c82f28 100644
+index b29174d..1a8f0bb 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -92,11 +92,11 @@ test('legacy-tests',
-      timeout: 600,
+      timeout: 900,
       env: test_env)
  #TODO: split out dbus tests into own test() instance, to run in parallel
 -test('unit-tests',
@@ -19,3 +30,6 @@ index 66cda8b..5c82f28 100644
 
  #TODO: the coverage section should probably be cleaned up a bit
  if get_option('b_coverage')
+-- 
+2.45.2
+

SPECS/netplan/netplan.signatures.json

@@ -1,5 +1,5 @@
 {
   "Signatures": {
-    "netplan-1.0.tar.gz": "863fb083a87d2c6b7dd9d46a9d702fffbb4aaf952c6b1d275016e56b1381527a"
+    "netplan-1.0.1.tar.gz": "7dfdcfc8134eca71af04c4e786a926a474ea95d4ebe86f7cab2efe9460c5d81e"
   }
 }

SPECS/netplan/netplan.spec

@@ -12,7 +12,7 @@
 
 
 Name:           netplan
-Version:        1.0
+Version:        1.0.1
 Release:        1%{?dist}
 Summary:        Network configuration tool using YAML
 Group:          System Environment/Base
@@ -22,11 +22,7 @@ License:        GPLv3
 URL:            https://netplan.io/
 Source0:        https://github.com/canonical/%{name}/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz
 
-# Fix bug in netplan when python3-rich is not present.
-Patch2:         rich-import-failure-no-log.patch
-
-# Temporarily disabling broken test suite due to version mismatches between
-# pytest-cov and python3-coverage in 3.0.
+# Temporarily disabling broken test suite due to version mismatches between pytest-cov and python3-coverage in 3.0.
 Patch3:         disable-broken-tests.patch
 
 BuildRequires:  bash-completion-devel
@@ -228,6 +224,10 @@ chmod 600 %{buildroot}%{_prefix}/lib/%{name}/00-netplan-default-renderer-network
 %meson_test
 
 %changelog
+* Mon Nov 04 2024 Sean Dougherty <sdougherty@microsoft.com> - 1.0.1-1
+- Upgrade to 1.0.1, which addresses CVE-2022-4968
+- Removed patch whose fix is now merged
+
 * Fri Mar 29 2024 Francisco Huelsz prince <frhuelsz@microsoft.com> - 1.0-1
 - Upgrade to 1.0
 

SPECS/netplan/rich-import-failure-no-log.patch

@@ -13922,8 +13922,8 @@
         "type": "other",
         "other": {
           "name": "netplan",
-          "version": "1.0",
-          "downloadUrl": "https://github.com/canonical/netplan/archive/refs/tags/1.0.tar.gz"
+          "version": "1.0.1",
+          "downloadUrl": "https://github.com/canonical/netplan/archive/refs/tags/1.0.1.tar.gz"
         }
       }
     },