nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: GoogleCloudPlatform/google-auth-library-python
Pull request #197 (2017-09-12 17:03:18)

Fix App Engine's expiration calculation
Resolves https://github.com/GoogleCloudPlatform/google-cloud-python/issues/3937

dhermes: LGTM, though WDYT about adding a script here that will deploy a new GAE app and run unit tests there (with results available via `curl`, e.g.)
jonparrott: > LGTM, though WDYT about adding a script here that will deploy a new GAE app and run unit tests there (with results available via curl, e.g.)

We have one in system_tests, it just doesn't do any introspection on the token or expiry - it just makes an authenticated request and verifies it works.

Patch:
diff --git a/google/auth/app_engine.py b/google/auth/app_engine.py
index 6dc8712..fa13f8e 100644
--- a/google/auth/app_engine.py
+++ b/google/auth/app_engine.py
@@ -114,7 +114,7 @@ class Credentials(credentials.Scoped, credentials.Signing,
         # pylint: disable=unused-argument
         token, ttl = app_identity.get_access_token(
             self._scopes, self._service_account_id)
-        expiry = _helpers.utcnow() + datetime.timedelta(seconds=ttl)
+        expiry = datetime.datetime.utcfromtimestamp(ttl)
 
         self.token, self.expiry = token, expiry
 


Test patch:
diff --git a/tests/test_app_engine.py b/tests/test_app_engine.py
index 9a62359..70fa5ca 100644
--- a/tests/test_app_engine.py
+++ b/tests/test_app_engine.py
@@ -17,7 +17,6 @@ import datetime
 import mock
 import pytest
 
-from google.auth import _helpers
 from google.auth import app_engine
 
 
@@ -134,7 +133,7 @@ class TestCredentials(object):
         return_value=datetime.datetime.min)
     def test_refresh(self, utcnow, app_identity):
         token = 'token'
-        ttl = _helpers.CLOCK_SKEW_SECS + 100
+        ttl = 643942923
         app_identity.get_access_token.return_value = token, ttl
         credentials = app_engine.Credentials(scopes=['email'])
 
@@ -143,8 +142,8 @@ class TestCredentials(object):
         app_identity.get_access_token.assert_called_with(
             credentials.scopes, credentials._service_account_id)
         assert credentials.token == token
-        assert credentials.expiry == (
-            utcnow() + datetime.timedelta(seconds=ttl))
+        assert credentials.expiry == datetime.datetime(
+            1990, 5, 29, 1, 2, 3)
         assert credentials.valid
         assert not credentials.expired
Repository: osbuild/osbuild
Pull request #1766 (2024-04-29 15:41:58)

sources/curl: Use our own User-Agent
Currently, osbuild downloads are identified as coming from `curl`. This
is unfortunate because some RPM mirrors block requests from curl. Let's
"fix" that by introducing our own user-agent. While this can certainly
be seen as "circumventing" a policy, I think that this change is
actually helpful: Now, the mirror maintainers can actually distinguish
osbuild requests from regular curl calls. If they want to block osbuild,
they certainly can, we have no power there, but at least this allows
more fine-grained filtering.

Thanks @supakeen and @mvo5 for your suggestion!


Patch:
diff --git a/sources/org.osbuild.curl b/sources/org.osbuild.curl
index 670717a4..6a8293f2 100755
--- a/sources/org.osbuild.curl
+++ b/sources/org.osbuild.curl
@@ -20,6 +20,7 @@ up the download.
 
 import concurrent.futures
 import os
+import platform
 import subprocess
 import sys
 import tempfile
@@ -153,6 +154,7 @@ class CurlSource(sources.SourceService):
             # some mirrors are sometimes broken. retry manually, because we could be
             # redirected to a different, working, one on retry.
             return_code = 0
+            arch = platform.machine()
             for _ in range(10):
                 curl_command = [
                     "curl",
@@ -161,6 +163,7 @@ class CurlSource(sources.SourceService):
                     "--connect-timeout", "30",
                     "--fail",
                     "--location",
+                    "--header", f"User-Agent: osbuild (Linux.{arch}; https://osbuild.org/)",
                     "--output", checksum,
                 ]
                 if proxy:


Test patch:
diff --git a/sources/test/test_curl_source.py b/sources/test/test_curl_source.py
index 49813ad0..47c7849c 100644
--- a/sources/test/test_curl_source.py
+++ b/sources/test/test_curl_source.py
@@ -208,3 +208,20 @@ def test_curl_download_proxy(mocked_run, tmp_path, monkeypatch, sources_service,
             assert args[0][idx:idx + 2] == ["--proxy", "http://my-proxy"]
         else:
             assert "--proxy" not in args[0]
+
+
+@patch("subprocess.run")
+def test_curl_user_agent(mocked_run, tmp_path, sources_service):
+    test_sources = make_test_sources(tmp_path, 80, 2,)
+    fake_curl_downloader = FakeCurlDownloader(test_sources)
+    mocked_run.side_effect = fake_curl_downloader.faked_run
+
+    sources_service.cache = tmp_path / "curl-cache"
+    sources_service.cache.mkdir()
+    sources_service.fetch_all(test_sources)
+
+    for call_args in mocked_run.call_args_list:
+        args, _kwargs = call_args
+        idx = args[0].index("--header")
+        assert "User-Agent: osbuild" in args[0][idx + 1]
+        assert "https://osbuild.org/" in args[0][idx + 1]
Repository: mozilla/cargo-vet
Pull request #309 (2022-08-25 18:42:03)

Make criteria-map optional
- Fix clippy.
- Make criteria-map optional.



Patch:
diff --git a/src/flock.rs b/src/flock.rs
index 272e17a..a925828 100644
--- a/src/flock.rs
+++ b/src/flock.rs
@@ -274,7 +274,7 @@ fn acquire(
 
         Err(e) => {
             if !error_contended(&e) {
-                Err(e)?;
+                return Err(e.into());
             }
         }
     }
diff --git a/src/format.rs b/src/format.rs
index 02e03b0..8357316 100644
--- a/src/format.rs
+++ b/src/format.rs
@@ -387,6 +387,8 @@ pub struct RemoteImport {
     pub url: String,
     /// A list of criteria that are implied by foreign criteria
     #[serde(rename = "criteria-map")]
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
     pub criteria_map: Vec<CriteriaMapping>,
 }
 
diff --git a/src/storage.rs b/src/storage.rs
index f51ecf9..5ef9c79 100644
--- a/src/storage.rs
+++ b/src/storage.rs
@@ -666,7 +666,7 @@ fn process_imported_audits(
                     .map(|v| &mut v[..])
                     .unwrap_or(&mut []);
                 for existing_audit in existing_audits {
-                    for new_audit in &mut new_audits[..] {
+                    for new_audit in &mut *new_audits {
                         // Ignore `who` and `notes` for comparison, as they
                         // are not relevant semantically and might have been
                         // updated uneventfully.
@@ -1140,7 +1140,7 @@ impl Cache {
         // 0 = empty
         // 1 = some diff
         if status != 0 && status != 1 {
-            Err(CommandError::BadStatus(status))?;
+            return Err(CommandError::BadStatus(status).into());
         }
 
         let diffstat = String::from_utf8(out.stdout).map_err(CommandError::BadOutput)?;
@@ -1538,7 +1538,8 @@ where
                 source_code: Arc::new(NamedSource::new(file_name, string)),
                 span,
                 error,
-            })?
+            }
+            .into())
         }
     }
 }


Test patch:
diff --git a/src/tests/snapshots/cargo_vet__tests__import__peer_audits_exemption_minimize.snap b/src/tests/snapshots/cargo_vet__tests__import__peer_audits_exemption_minimize.snap
index f54b118..b570027 100644
--- a/src/tests/snapshots/cargo_vet__tests__import__peer_audits_exemption_minimize.snap
+++ b/src/tests/snapshots/cargo_vet__tests__import__peer_audits_exemption_minimize.snap
@@ -9,7 +9,6 @@ config.toml:
  
  [imports.peer-company]
  url = "https://peercompany.co.uk"
- criteria-map = []
  
  [[exemptions.third-party1]]
  version = "10.0.0"
Repository: osbuild/osbuild
Pull request #1805 (2024-06-18 08:24:48)

osbuild/monitor.py: improve naming of progress
Just improve naming of the progress steps…

This is a small preparation for handing over progress towards frontend.



Patch:
diff --git a/osbuild/monitor.py b/osbuild/monitor.py
index f0491914..fd1201c7 100644
--- a/osbuild/monitor.py
+++ b/osbuild/monitor.py
@@ -317,7 +317,7 @@ class JSONSeqMonitor(BaseMonitor):
     def begin(self, pipeline: osbuild.Pipeline):
         self._context.set_pipeline(pipeline)
         if pipeline.stages:
-            self._progress.sub_progress = Progress("stages", len(pipeline.stages))
+            self._progress.sub_progress = Progress(f"pipeline: {pipeline.name}", len(pipeline.stages))
         self.log(f"Starting pipeline {pipeline.name}", origin="osbuild.monitor")
 
     # finish is for pipelines


Test patch:
diff --git a/test/mod/test_monitor.py b/test/mod/test_monitor.py
index 75fb9ac6..7626d9fb 100644
--- a/test/mod/test_monitor.py
+++ b/test/mod/test_monitor.py
@@ -233,6 +233,7 @@ def test_json_progress_monitor():
         logitem = json.loads(log[i])
         assert logitem["message"] == "Starting pipeline test-pipeline-first"
         assert logitem["context"]["pipeline"]["name"] == "test-pipeline-first"
+        assert logitem["progress"]["progress"]["name"] == "pipeline: test-pipeline-first"
         # empty items are omited
         assert "name" not in logitem["context"]["pipeline"]["stage"]
         i += 1
@@ -276,6 +277,7 @@ def test_json_progress_monitor():
 
         logitem = json.loads(log[i])
         assert logitem["message"] == "Starting pipeline test-pipeline-second"
+        assert logitem["progress"]["progress"]["name"] == "pipeline: test-pipeline-second"
         assert logitem["context"]["origin"] == "osbuild.monitor"
         assert logitem["context"]["pipeline"]["name"] == "test-pipeline-second"
         i += 1
Repository: osbuild/osbuild
Pull request #1809 (2024-06-27 20:29:50)

sources/curl: use `--user-agent` option to set the user-agent
Setting the user-agent using `--header` is broken in combination with `--location`, `--proxy`, and an https endpoint which redirects. The user-agent sent to the proxy changes after the client is redirected, tripping up proxies.

For more information see https://issues.redhat.com/browse/RHEL-45364

bcl: Your changes look ok to me, but it seems that autopep8 is unhappy with osbuid as well as some f38 urls that are now 404?

Patch:
diff --git a/sources/org.osbuild.curl b/sources/org.osbuild.curl
index 6a8293f2..05ee0781 100755
--- a/sources/org.osbuild.curl
+++ b/sources/org.osbuild.curl
@@ -163,7 +163,7 @@ class CurlSource(sources.SourceService):
                     "--connect-timeout", "30",
                     "--fail",
                     "--location",
-                    "--header", f"User-Agent: osbuild (Linux.{arch}; https://osbuild.org/)",
+                    "--user-agent", f"osbuild (Linux.{arch}; https://osbuild.org/)",
                     "--output", checksum,
                 ]
                 if proxy:


Test patch:
diff --git a/sources/test/test_curl_source.py b/sources/test/test_curl_source.py
index 47c7849c..9611df7f 100644
--- a/sources/test/test_curl_source.py
+++ b/sources/test/test_curl_source.py
@@ -222,6 +222,6 @@ def test_curl_user_agent(mocked_run, tmp_path, sources_service):
 
     for call_args in mocked_run.call_args_list:
         args, _kwargs = call_args
-        idx = args[0].index("--header")
-        assert "User-Agent: osbuild" in args[0][idx + 1]
+        idx = args[0].index("--user-agent")
+        assert "osbuild" in args[0][idx + 1]
         assert "https://osbuild.org/" in args[0][idx + 1]
Repository: osbuild/osbuild
Pull request #1811 (2024-07-08 10:52:44)

sources(curl): disable `curl --parallel` by default
Disable `curl --parallel` by default until the failure in https://github.com/osbuild/osbuild-composer/pull/4247

is fully understood. It can be enabled via the environment:
```
OSBUILD_SOURCES_CURL_USE_PARALLEL=1
```
in the osbuild-composer test.

achilleas-k: Let's pull this into your osbuild-composer PR and see if it fixes the issues.

Patch:
diff --git a/sources/org.osbuild.curl b/sources/org.osbuild.curl
index e6f016f7..db271ff3 100755
--- a/sources/org.osbuild.curl
+++ b/sources/org.osbuild.curl
@@ -102,6 +102,12 @@ def curl_has_parallel_downloads():
     Return true if curl has all the support we needed for parallel downloading
     (this include --write-out "%{json}" too
     """
+    # Re-enable this once the failures in
+    # https://github.com/osbuild/osbuild-composer/pull/4247
+    # are understood
+    if os.getenv("OSBUILD_SOURCES_CURL_USE_PARALLEL") not in ["1", "yes", "true"]:
+        return False
+
     output = subprocess.check_output(["curl", "--version"], universal_newlines=True)
     first_line = output.split("\n", maxsplit=1)[0]
     m = re.match(r'^curl (\d+\.\d+\.\d+)', first_line)


Test patch:
diff --git a/sources/test/test_curl_source.py b/sources/test/test_curl_source.py
index 0daea2c1..a3fd45f0 100644
--- a/sources/test/test_curl_source.py
+++ b/sources/test/test_curl_source.py
@@ -160,7 +160,9 @@ def test_curl_download_many_chksum_validate(tmp_path, curl_parallel):
 
 
 @pytest.mark.parametrize("curl_parallel", [True, False], indirect=["curl_parallel"])
-def test_curl_download_many_retries(tmp_path, curl_parallel):
+def test_curl_download_many_retries(tmp_path, monkeypatch, curl_parallel):
+    monkeypatch.setenv("OSBUILD_SOURCES_CURL_USE_PARALLEL", "1")
+
     fake_httpd_root = tmp_path / "fake-httpd-root"
 
     with http_serve_directory(fake_httpd_root) as httpd:
@@ -291,7 +293,14 @@ Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz
 
 
 @patch("subprocess.check_output")
-def test_curl_has_parallel_download(mocked_check_output, sources_module):
+def test_curl_has_parallel_download(mocked_check_output, monkeypatch, sources_module):
+    # by default, --parallel is disabled
+    mocked_check_output.return_value = NEW_CURL_OUTPUT
+    assert not sources_module.curl_has_parallel_downloads()
+
+    # unless this environemnt is set
+    monkeypatch.setenv("OSBUILD_SOURCES_CURL_USE_PARALLEL", "1")
+
     mocked_check_output.return_value = NEW_CURL_OUTPUT
     assert sources_module.curl_has_parallel_downloads()
Repository: osbuild/osbuild
Pull request #1823 (2024-07-24 10:11:26)

stages/autotailor: fix stage schema
There was a small mistake in the schema since either one of `new_profile` or `tailored_profile_id` is required. 
This commit fixes this and updates the tests to check for this case.


Patch:
diff --git a/stages/org.osbuild.oscap.autotailor.meta.json b/stages/org.osbuild.oscap.autotailor.meta.json
index 11091790..8d4daede 100644
--- a/stages/org.osbuild.oscap.autotailor.meta.json
+++ b/stages/org.osbuild.oscap.autotailor.meta.json
@@ -36,9 +36,21 @@
       },
       "tailoring": {
         "additionalProperties": false,
-        "required": [
-          "profile_id",
-          "datastream"
+        "oneOf": [
+          {
+            "required": [
+              "profile_id",
+              "datastream",
+              "new_profile"
+            ]
+          },
+          {
+            "required": [
+              "profile_id",
+              "datastream",
+              "tailored_profile_id"
+            ]
+          }
         ],
         "type": "object",
         "description": "OpenSCAP configuration variables",


Test patch:
diff --git a/stages/test/test_autotailor.py b/stages/test/test_autotailor.py
index c06c42e0..00bfe0e0 100644
--- a/stages/test/test_autotailor.py
+++ b/stages/test/test_autotailor.py
@@ -148,6 +148,11 @@ def test_oscap_autotailor_json_smoke(mock_subprocess_run, fake_json_input, stage
             "tailored_profile_id": "some-new-profile"
         }, "{'datastream': 'some-datastream', 'tailored_profile_id': 'some-new-profile'}"
             + " is not valid under any of the given schemas"),
+        ({
+            "datastream": "some-datastream",
+            "profile_id": "some-profile-id",
+        }, "{'datastream': 'some-datastream', 'profile_id': 'some-profile-id'}"
+            + " is not valid under any of the given schemas"),
         ({
             "datastream": "some-datastream",
             "tailoring_file": "/some/tailoring/file.json"
Repository: osbuild/osbuild
Pull request #1824 (2024-07-25 08:30:19)

Test: fix dnf4.mark stage test with DNF5
DNF5 contains a breaking change in the repoquery --qf output, specifically it does not include the trailing newline. This breaks the test case e.g. on the latest Fedora Rawhide [1].

As a fix, explicitly use 'dnf4' for now, until the inconsistency is fixed in the upstream [2].

[1] https://artifacts.dev.testing-farm.io/3a3a2898-0a6a-42eb-8792-660f03c35c3c/
[2] https://github.com/rpm-software-management/dnf5/issues/709


Patch:
diff --git a/stages/org.osbuild.oscap.autotailor.meta.json b/stages/org.osbuild.oscap.autotailor.meta.json
index 11091790..8d4daede 100644
--- a/stages/org.osbuild.oscap.autotailor.meta.json
+++ b/stages/org.osbuild.oscap.autotailor.meta.json
@@ -36,9 +36,21 @@
       },
       "tailoring": {
         "additionalProperties": false,
-        "required": [
-          "profile_id",
-          "datastream"
+        "oneOf": [
+          {
+            "required": [
+              "profile_id",
+              "datastream",
+              "new_profile"
+            ]
+          },
+          {
+            "required": [
+              "profile_id",
+              "datastream",
+              "tailored_profile_id"
+            ]
+          }
         ],
         "type": "object",
         "description": "OpenSCAP configuration variables",


Test patch:
diff --git a/stages/test/test_autotailor.py b/stages/test/test_autotailor.py
index c06c42e0..00bfe0e0 100644
--- a/stages/test/test_autotailor.py
+++ b/stages/test/test_autotailor.py
@@ -148,6 +148,11 @@ def test_oscap_autotailor_json_smoke(mock_subprocess_run, fake_json_input, stage
             "tailored_profile_id": "some-new-profile"
         }, "{'datastream': 'some-datastream', 'tailored_profile_id': 'some-new-profile'}"
             + " is not valid under any of the given schemas"),
+        ({
+            "datastream": "some-datastream",
+            "profile_id": "some-profile-id",
+        }, "{'datastream': 'some-datastream', 'profile_id': 'some-profile-id'}"
+            + " is not valid under any of the given schemas"),
         ({
             "datastream": "some-datastream",
             "tailoring_file": "/some/tailoring/file.json"
diff --git a/test/run/test_stages.py b/test/run/test_stages.py
index a4d78b7e..ca224f07 100644
--- a/test/run/test_stages.py
+++ b/test/run/test_stages.py
@@ -537,9 +537,12 @@ class TestStages(test.TestBase):
             assert os.path.isdir(tree)
 
             # we're going to verify that packages in the tree are marked according to
+            # Explicitly use 'dnf4' for now, because 'dnf5' contains a breaking change
+            # in the repoquery --qf output, specifically it does not add a trailing newline.
+            # We can use plan 'dnf' again once https://github.com/rpm-software-management/dnf5/issues/709 is fixed.
             r = subprocess.run(
                 [
-                    "dnf",
+                    "dnf4",
                     "--installroot", tree,
                     "repoquery", "--installed",
                     "--qf", "%{name},%{reason}"
Repository: osbuild/osbuild
Pull request #1840 (2024-08-12 12:42:00)

jsoncom: gracefully report EMSGSIZE errors
When `jsoncomm` fails because the message is too big it currently does not indicate just how big the message was. This commit adds this information so that it's easier for us to determine what to do about it.

We could also include a pointer to `/proc/sys/net/core/wmem_defaults` but it seems we want to not require fiddling with that so let's not do it for now.

See also https://github.com/osbuild/osbuild/pull/1838 and https://github.com/osbuild/osbuild/pull/1833 


Patch:
diff --git a/osbuild/util/jsoncomm.py b/osbuild/util/jsoncomm.py
index e31a49ca..04821257 100644
--- a/osbuild/util/jsoncomm.py
+++ b/osbuild/util/jsoncomm.py
@@ -404,7 +404,13 @@ class Socket(contextlib.AbstractContextManager):
         if fds:
             cmsg.append((socket.SOL_SOCKET, socket.SCM_RIGHTS, array.array("i", fds)))
 
-        n = self._socket.sendmsg([serialized], cmsg, 0)
+        try:
+            n = self._socket.sendmsg([serialized], cmsg, 0)
+        except OSError as exc:
+            if exc.errno == errno.EMSGSIZE:
+                raise BufferError(
+                    f"jsoncomm message size {len(serialized)} is too big") from exc
+            raise exc
         assert n == len(serialized)
 
     def send_and_recv(self, payload: object, *, fds: Optional[list] = None):


Test patch:
diff --git a/test/mod/test_util_jsoncomm.py b/test/mod/test_util_jsoncomm.py
index 2d8eae26..93d62a13 100644
--- a/test/mod/test_util_jsoncomm.py
+++ b/test/mod/test_util_jsoncomm.py
@@ -3,12 +3,15 @@
 #
 
 import asyncio
+import errno
 import os
 import pathlib
 import tempfile
 import unittest
 from concurrent import futures
 
+import pytest
+
 from osbuild.util import jsoncomm
 
 
@@ -216,3 +219,12 @@ class TestUtilJsonComm(unittest.TestCase):
         self.assertEqual(ping, pong)
         pong, _, _ = a.recv()
         self.assertEqual(ping, pong)
+
+    def test_send_and_recv_tons_of_data_still_errors(self):
+        a, _ = jsoncomm.Socket.new_pair()
+
+        ping = {"data": "1" * 1_000_000}
+        with pytest.raises(BufferError) as exc:
+            a.send(ping)
+        assert str(exc.value) == "jsoncomm message size 1000012 is too big"
+        assert exc.value.__cause__.errno == errno.EMSGSIZE