check_software: fix warning on python2
On python2, warnings.warn expects the message to be passed as a str and it will silently output nothing when the message is an unicode that can not be converted to str using ascii encoding (cf. https://bugs.python.org/issue34752 ) Since october update of pyupio/safety-db there is a new vulnerability for pytest-runner, which is described as: "pytest-runner": [ { "advisory": "Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example \u2018setup_requires\u2019 and \u2018tests_require\u2019 bypass pip --require-hashes. See also pypa/setuptools#1684.\r\nIt is recommended that you:\r\n- Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option.\r\n- Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option.\r\n- Select a tool to bootstrap and then run tests such as tox.", "cve": "PVE-2021-43313", "id": "pyup.io-43313", "specs": [ ">0" ], "v": ">0" } ], notice the quotes: \u2018setup_requires\u2019 and \u2018tests_require\u2019 this was sent to warnings.warn as unicode and because all our softwares have this vulnerability (that BTW do not impact us because we run buildout with a patch for setup_requires), we no longer saw any warning on python2 software release tests.
Showing
Please register or sign in to comment