{"action":"created","issue":{"url":"https://api.github.com/repos/puppetlabs/puppet/issues/5024","repository_url":"https://api.github.com/repos/puppetlabs/puppet","labels_url":"https://api.github.com/repos/puppetlabs/puppet/issues/5024/labels{/name}","comments_url":"https://api.github.com/repos/puppetlabs/puppet/issues/5024/comments","events_url":"https://api.github.com/repos/puppetlabs/puppet/issues/5024/events","html_url":"https://github.com/puppetlabs/puppet/pull/5024","id":160534036,"number":5024,"title":"(PUP-6413) Use https when talking to pypi","user":{"login":"nibalizer","id":195179,"avatar_url":"https://avatars.githubusercontent.com/u/195179?v=3","gravatar_id":"","url":"https://api.github.com/users/nibalizer","html_url":"https://github.com/nibalizer","followers_url":"https://api.github.com/users/nibalizer/followers","following_url":"https://api.github.com/users/nibalizer/following{/other_user}","gists_url":"https://api.github.com/users/nibalizer/gists{/gist_id}","starred_url":"https://api.github.com/users/nibalizer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nibalizer/subscriptions","organizations_url":"https://api.github.com/users/nibalizer/orgs","repos_url":"https://api.github.com/users/nibalizer/repos","events_url":"https://api.github.com/users/nibalizer/events{/privacy}","received_events_url":"https://api.github.com/users/nibalizer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/puppetlabs/puppet/labels/Waiting%20on%20Contributor","name":"Waiting on Contributor","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-06-15T22:00:23Z","updated_at":"2016-06-16T02:00:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/puppetlabs/puppet/pulls/5024","html_url":"https://github.com/puppetlabs/puppet/pull/5024","diff_url":"https://github.com/puppetlabs/puppet/pull/5024.diff","patch_url":"https://github.com/puppetlabs/puppet/pull/5024.patch"},"body":"We really shouldn't use this code any more. But we are using it.\r\nPypi changed behaviour today because of vulnerabilities in urrlib, which\r\nis used by pip.\r\n\r\nhttp://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html\r\n\r\nPypi changed to denying http requests entirely instead of redirecting to\r\nhttps. (I guess? I don't really understand)\r\n\r\nWithout this patch:\r\n\r\nroot@derpderp:~# cat foo.pp\r\n    package { 'diskimage-builder':\r\n      ensure   => latest,\r\n      provider => pip,\r\n   }\r\n\r\nroot@derpderp:~# puppet apply foo.pp\r\nWarning: Setting templatedir is deprecated. See http://links.puppetlabs.com/env-settings-deprecations\r\n   (at /usr/lib/ruby/vendor_ruby/puppet/settings.rb:1139:in `issue_deprecation_warning')\r\nNotice: Compiled catalog for derpderp in environment production in 0.14 seconds\r\nError: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP\r\nError: /Stage[main]/Main/Package[diskimage-builder]/ensure: change from 1.17.0 to latest failed: Could not get latest version: HTTP-Error: 403 Must access using HTTPS instead of HTTP\r\nNotice: Finished catalog run in 0.67 seconds\r\n\r\nSo this breaks any puppet 3.x using the default pip provider.\r\n\r\nWith this patch, it just works."},"comment":{"url":"https://api.github.com/repos/puppetlabs/puppet/issues/comments/226369389","html_url":"https://github.com/puppetlabs/puppet/pull/5024#issuecomment-226369389","issue_url":"https://api.github.com/repos/puppetlabs/puppet/issues/5024","id":226369389,"user":{"login":"puppetcla","id":3835957,"avatar_url":"https://avatars.githubusercontent.com/u/3835957?v=3","gravatar_id":"","url":"https://api.github.com/users/puppetcla","html_url":"https://github.com/puppetcla","followers_url":"https://api.github.com/users/puppetcla/followers","following_url":"https://api.github.com/users/puppetcla/following{/other_user}","gists_url":"https://api.github.com/users/puppetcla/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetcla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetcla/subscriptions","organizations_url":"https://api.github.com/users/puppetcla/orgs","repos_url":"https://api.github.com/users/puppetcla/repos","events_url":"https://api.github.com/users/puppetcla/events{/privacy}","received_events_url":"https://api.github.com/users/puppetcla/received_events","type":"User","site_admin":false},"created_at":"2016-06-16T02:00:17Z","updated_at":"2016-06-16T02:00:17Z","body":"CLA signed by all contributors."}}
{"actor":{"display_login":"puppetcla"}}