(PUP-6413) Use https when talking to pypi #5024
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@nibalizer woot, thanks! Seems simple enough 👍, I think we should be able to review this soon |
whopper
changed the title
|
As a workaround, we can use the 'openstack_pip' provider here http://git.openstack.org/cgit/openstack-infra/puppet-pip/tree/ |
|
@nibalizer ah, there are a few instances of |
|
+1 on this pull request. |
|
CLA signed by all contributors. |
|
+1 We need this ASAP on 3.x and 4.x |
We really shouldn't use this code any more. But we are using it. Pypi changed behaviour today because of vulnerabilities in urrlib, which is used by pip. http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html Pypi changed to denying http requests entirely instead of redirecting to https when the Content-Type is text/xml and the Accept is application/xml Example: root@derpderp:~# curl -L -H "Accept: application/xml" -H "Content-Type: text/xml" -X POST "http://pypi.python.org/pypi/" Forbidden Must access using HTTPS instead of HTTP Without this patch: root@derpderp:~# cat foo.pp package { 'diskimage-builder': ensure => latest, provider => pip, } root@derpderp:~# puppet apply foo.pp Warning: Setting templatedir is deprecated. See http://links.puppetlabs.com/env-settings-deprecations (at /usr/lib/ruby/vendor_ruby/puppet/settings.rb:1139:in `issue_deprecation_warning') Notice: Compiled catalog for derpderp in environment production in 0.14 seconds Error: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP Error: /Stage[main]/Main/Package[diskimage-builder]/ensure: change from 1.17.0 to latest failed: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP Notice: Finished catalog run in 0.67 seconds So this breaks any puppet 3.x using the default pip provider. With this patch, it just works.
|
@whopper updated. |
|
Can we expect a new 3.x release soon? |
mattj-io
pushed a commit
to datacentred/puppet
that referenced
this pull request
Jul 4, 2016
l0b0
added a commit
to l0b0/root
that referenced
this pull request
Oct 8, 2016
esycat
added a commit
to esycat/puppet-pip
that referenced
this pull request
Jan 2, 2018
See also [PUP-6413](puppetlabs/puppet#5024).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We really shouldn't use this code any more. But we are using it.
Pypi changed behaviour today because of vulnerabilities in urrlib, which
is used by pip.
http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
Pypi changed to denying http requests entirely instead of redirecting to
https. (I guess? I don't really understand)
Without this patch:
root@derpderp:~# cat foo.pp
package { 'diskimage-builder':
ensure => latest,
provider => pip,
}
root@derpderp:~# puppet apply foo.pp
Warning: Setting templatedir is deprecated. See http://links.puppetlabs.com/env-settings-deprecations
(at /usr/lib/ruby/vendor_ruby/puppet/settings.rb:1139:in `issue_deprecation_warning')
Notice: Compiled catalog for derpderp in environment production in 0.14 seconds
Error: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP
Error: /Stage[main]/Main/Package[diskimage-builder]/ensure: change from 1.17.0 to latest failed: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP
Notice: Finished catalog run in 0.67 seconds
So this breaks any puppet 3.x using the default pip provider.
With this patch, it just works.