test_report_header defines an inline conftest.py using the
pytest_report_header(startdir) hook signature; newer pytest pluggy
hook-signature validation rejects "startdir" (renamed to start_path
long ago), so the nested pytest subprocess it spawns exits with
PluginValidationError/INTERNAL_ERROR, and the outer assert
result.ret == 0 fails. Version-skew in pytest-sugars own test suite,
not a runtime bug.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_marker_function/_and_fixture/_class/_module use the "testdir"
fixture, provided by pytest builtin pytester plugin. That plugin is
not autoloaded; upstream pyproject.toml sets addopts = "-p pytester"
but that file is not shipped into the ptest tree, so the fixture is
unavailable and these 4 tests error out (fixture testdir not found).
Pass -p pytester directly in run-ptest.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
time_machine's C-level time/timezone patching relies on libc's
tzset()//usr/share/zoneinfo, which requires the system tzdata package -
distinct from python3-tzdata (Python's importlib zoneinfo data), which
the recipe already had. Add tzdata to RDEPENDS:${PN}-ptest.
Deselect test_destination_datetime_tzinfo_non_zoneinfo: it builds an
aware datetime from dateutil's tz.gettz("America/Chicago") and expects
the CST (-6h) offset at the 1970 epoch. OE builds /usr/share/zoneinfo
in "slim" format (zic -b slim); dateutil's tzfile parser mishandles
the pre-first-transition instant of a slim tzfile and returns a 0
(UTC) offset there, so the epoch maps to 0 instead of 21600. Python's
own zoneinfo reads the same file correctly, so this is a
dateutil/slim-tzdata limitation, not a time_machine bug.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Skip test_send_binary_data_to_server_bigger_than_default_on_websockets,
test_multiprocess_health_check and test_multiprocess_sighup, and drop
use_colors from the test config, all of which don't hold up in the
ptest QEMU environment.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_literal_values_unhashable_type asserts that duplicate unhashable
Literal values (e.g. Literal[[1, 'a'], [1, 'a']]) are preserved, but
CPython 3.13.15+ deduplicates unhashable Literal args at construction
time (python/cpython#153914). Upstream fixed this the same way
starting in 0.4.4 by skipping the test on newer Python; backport that
same guard here since this recipe is pinned to 0.4.2.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Force a wide console (COLUMNS=200) so rich does not wrap/truncate the
error-panel text. Several tests assert on trailing substrings ("is a
file", "is a directory", "unknown error") of long error messages
that get word-wrapped - and thus split - inside an 80-column rich
panel when stdout is not a tty (as in the ptest QEMU environment). A
wide terminal keeps the message on one line.
test_binary_stderr spawns a fresh interpreter to run the test file as
a script; the file does "from tests.utils import ...", so the ptest
root (the parent of tests/) must be importable in that subprocess -
export it via PYTHONPATH.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_endarray_leak asserts sys.getrefcount(j1['v']) == 3, but modern
CPython's specialized dict/subscript bytecode holds one fewer
temporary reference during the call, so the real count is 2 regardless
of environment (reproduces on plain upstream CPython 3.13, unrelated
to this target). Upstream test-authoring assumption broken by CPython
internals, not a packaging issue.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_process_teardown forks a child process while the parent has an
active zmq/asyncio context (ZeroMQ's own docs call forking with a live
context+IO-thread undefined behavior); under qemu's slower/different
scheduling the forked child intermittently dies with exit code 1
instead of exiting 0. Reproduces reliably on target but never locally
(isolated, whole-file, or whole-suite runs all pass), consistent with
an environment-specific fork-safety issue rather than a logic bug.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
astroid 4.1.2 (the version this distro packages) changed how it
resolves the enclosing scope/parent name and end_lineno for decorated
functions, singledispatch registrations, positional-only-arg checks
and a few other node kinds. These functional tests were pinned against
an older astroid's output and fail with plain output-text mismatches
(not logic errors) once run against 4.1.2. Regenerated the expected
.txt fixtures against astroid==4.1.2, mirroring the existing
0001-Adjust-test-expectations-for-ptest.patch approach for this
recipe.
tests/functional/u/undefined/undefined_variable.314.txt is pylint's
own Python-3.14-specific override of undefined_variable.txt (see
FunctionalTestFile.expected_output, which prefers a
"<base>.<ver>.txt" file over the plain one when it matches the
running interpreter). The distro's target Python is 3.14.7, so this
file - not the plain .txt - is what actually gets read during ptest,
and it still carried the pre-4.1.2 astroid values for the same two
lines. Applied the identical fix there too.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Guard each shell test case with a dbus-launch availability check and
emit SKIP instead of hard-failing when it isn't installed.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_docs.py lint-checks every doc/docstring code example through
ruff (via pytest-examples). The installed ruff's rule set is not
version-locked to what pydantic's examples were written for, so ~130
style rules (import sorting, future-annotations, datetime-tz, etc.)
get flagged as failures that are not runtime bugs. Disable only the
lint step in test_docs.py; the examples are still executed.
test_deprecated_fields.py uses pytest.warns(Warning, callable,
match=...); newer pytest forwards match= to the callable instead of
consuming it, so these raise "unexpected keyword argument 'match'".
pytest API version skew; deselect via the existing -k mechanism.
test_internal.py's test_representation_integrations needs asttokens
(via executing/devtools.debug); add python3-asttokens to
RDEPENDS:${PN}-ptest.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_dict_empty round-trips a 4096x4096 nested structure through JSON,
materializing ~16.7M real dict objects on loads() (~900MB+ RSS), which
gets OOM-killed on the memory-constrained qemu ptest target.
test_fake.py instantiates Faker with 9 locales at once, pulling in a
similarly large amount of locale provider data, for what is a
Unicode-robustness smoke test rather than core JSON logic.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
tests/test_cli.py and tests/conftest.py use pytest's monkeypatch
"not set" sentinel, renamed from lowercase 'notset' to 'NOTSET' in
pytest 9.1; rewrite the references in the installed ptest copy.
werkzeug 3.1.x's get_host() no longer raises SecurityError for a Host
header with invalid/non-printable characters when no trusted_hosts is
configured (flask's default) - it silently returns "" and the request
routes to a 404 instead of the 400 test_bad_environ_raises_bad_request
expects against older werkzeug. Version-skew, not a flask bug; skip
the test.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
tests/ imports itself as "tests.*" and pulls in "capabilities" from
the sibling tasks/ dir; upstream's pyproject.toml sets
[tool.pytest] pythonpath = [".", "tasks"] to make both resolve, so
ship tasks/ and pyproject.toml into the ptest install too.
Also disable pytest's cache plugin: the non-root "tester" user ptest
runs as can't write a cache dir under the read-only-to-them
/usr/lib/python3-filelock/ptest install path.
Add python3-pytest-timeout, used by the test suite.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The PyPI sdist ships no tests/ directory at all, so ptest had nothing
to run from it (pytest exits 5, "no tests collected"). Fetch the
matching git tag instead, which does include tests/, mirroring
python3-pydantic's fetch pattern.
Also set asyncio_mode=auto via a ptest-local pytest.ini:
tests/test_adapter_deprecation.py has plain "async def" tests with no
@pytest.mark.asyncio marker; they rely on upstream's pyproject.toml
setting asyncio_mode=auto, which isn't shipped into the ptest package.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The product-only "twisted" value emits a wildcard-vendor identity
instead of the active identity assigned to the packaged Twisted source.
Use "twisted:twisted" for its NVD dictionary CPE, NVD configuration,
and CNA affected-data identities. With sbom-cve-check 1.3.3 and the
pinned database snapshots, the generated product identity changes; the
current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:ujson" mapping does not match the UltraJSON identities used by NVD and CVE List V5, so source-aligned CVEs are missed.
Use "ultrajson:ultrajson" for the CNA affected-data identity and "ultrajson_project:ultrajson" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "tweepy" value emits a wildcard-vendor identity and
hides the distinct NVD identities assigned to the packaged Tweepy source.
Use "josh_roesslein:tweepy" for its NVD dictionary CPE and
"tweepy:tweepy" for the NVD configuration-only identity. With
sbom-cve-check 1.3.3 and the pinned database snapshots, the generated
product identity changes; the current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "flask-user" mapping emits the wildcard-vendor
*:flask-user CPE instead of the exact NVD identity for the packaged
lingthio/Flask-User source.
Use "flask-user_project:flask-user", which is both an NVD dictionary
CPE and an NVD configuration identity. CNA affected data uses
"n/a:Flask-User" and remains covered by scanner aliases. With
sbom-cve-check 1.3.3 and the pinned 2026-08-12 data, the generated
identity changes but CVE-2021-23401 remains reported as affected.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "flask" mapping emits the wildcard-vendor *:flask CPE
instead of the exact NVD identity for the packaged pallets/flask
source.
Use "palletsprojects:flask", which is both an NVD dictionary CPE and
an NVD configuration identity. CNA affected data uses "pallets:flask"
and "The Pallets Project:Flask", which remain covered by scanner
aliases. With sbom-cve-check 1.3.3 and the pinned 2026-08-12 data, the
generated identity changes but the current CVE report does not.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current "aiohttp" mapping emits the wildcard-vendor *:aiohttp CPE
instead of the exact NVD identity for the packaged aio-libs/aiohttp
source.
Use "aiohttp:aiohttp", which is both an NVD dictionary CPE and an NVD
configuration identity. CNA affected data uses "aio-libs:aiohttp" and
remains covered by scanner aliases. With sbom-cve-check 1.3.3 and the
pinned 2026-08-12 data, the generated identity changes but the current
CVE report does not.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "waitress" mapping emits a wildcard-vendor identity instead of the exact identities assigned to the packaged Pylons source.
Use "pylons:waitress" for the CNA affected-data identity and "agendaless:waitress" for the NVD dictionary CPE and configuration identity. This changes the generated product identity, but sbom-cve-check 1.3.3 with the pinned databases leaves the current CVE report unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "werkzeug" mapping emits a wildcard-vendor identity instead of the exact identities assigned to the packaged Pallets source.
Use "pallets:werkzeug" for the CNA affected-data identity and "palletsprojects:werkzeug" for the NVD dictionary CPE and configuration identity. This changes the generated product identity, but sbom-cve-check 1.3.3 with the pinned databases leaves the current CVE report unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "pymongo" value emits a wildcard-vendor identity and
omits the second authoritative name for the packaged MongoDB Python
driver.
Use "mongodb:python_driver" for its NVD dictionary CPE family and
"mongodb:pymongo" for its NVD dictionary CPE and configuration identity.
With sbom-cve-check 1.3.3 and the pinned database snapshots, the
generated product identity changes; the current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "m2crypto" mapping generates a wildcard-vendor
identity instead of the two vendors used for the packaged source.
Use "heikkitoivonen:m2crypto" and "m2crypto_project:m2crypto" for their
exact NVD dictionary CPE and NVD configuration identities. This changes
the generated CPE set, but sbom-cve-check 1.3.3 with the pinned NVD
snapshot has no current CVE report delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "py" mapping generates a wildcard-vendor identity
instead of the exact NVD identity for the packaged pytest-dev py
source. Use "pytest:py" for its NVD dictionary CPE and configuration
matches.
This changes the generated product identity. With sbom-cve-check 1.3.3,
the current CVE report is unchanged using the pinned database snapshots;
both mappings report CVE-2020-29651 and CVE-2022-42969.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:simpleeval" mapping is wrong for the
packaged danthedeckie SimpleEval source and misses its vulnerability
record.
Use "danthedeckie:simpleeval" for the source-aligned NVD dictionary
CPE, NVD configuration identity, and CNA affected-data identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ankur Tyagi
Khem Raj
Jaipaul Cheernam
Peter Marko
Wang Mingyu
Devansh Patel