From 9ad37376053bc9ec7fba22a60862b107dbe8d738 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 08:42:04 +0000
Subject: [PATCH 01/10] [python] - setuptools -  GHSA-cx63-2mw6-8hw5 - reqd. to
 be updated to v70.0.0

---
 src/python/install.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index e6702add9..af053759a 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -857,7 +857,7 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 mkdir -p /tmp/setuptools_downloaded
                 cd /tmp/setuptools_downloaded
                 # download the source distribution for setuptools using pip
-                pip download setuptools==65.5.1 --no-binary :all:
+                pip download setuptools==70.0.0 --no-binary :all:
                 # extract the filename of the setuptools-*.tar.gz file
                 filename=$(find . -maxdepth 1 -type f)
                 # create a directory to store unpacked contents of the source distribution
@@ -865,18 +865,20 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 # extract the contents inside the new directory
                 tar -xzf $filename -C /tmp/setuptools_src_dist
                 # move to the setuptools-* directory inside /setuptools_src_dist
-                cd /tmp/setuptools_src_dist/setuptools-65.5.1/
+                cd /tmp/setuptools_src_dist/setuptools-70.0.0/
                 # look for setup.py file in the current directory and create a wheel file
                 python setup.py bdist_wheel
                 # move inside the dist directory in pwd
                 cd dist
                 # copy this file to the ensurepip/_bundled directory
-                cp setuptools-65.5.1-py3-none-any.whl /usr/local/lib/python${PY_MAJOR_MINOR_VER}/ensurepip/_bundled/
+                cp setuptools-70.0.0-py3-none-any.whl /usr/local/lib/python${PY_MAJOR_MINOR_VER}/ensurepip/_bundled/
                 # replace the version in __init__.py file with the installed version
-                sed -i 's/_SETUPTOOLS_VERSION = \"65\.5\.0\"/_SETUPTOOLS_VERSION = "65.5.1"/g' /usr/local/lib/"python${PY_MAJOR_MINOR_VER}"/ensurepip/__init__.py
+                sed -i 's/_SETUPTOOLS_VERSION = \"65\.5\.0\"/_SETUPTOOLS_VERSION = "70.0.0"/g' /usr/local/lib/"python${PY_MAJOR_MINOR_VER}"/ensurepip/__init__.py
                 # cleanup created dir's
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
+        else 
+            install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
         fi
     fi
 

From d50b3b5ed0568b01a56e0c2a6966d0ce2f42fc17 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 08:56:33 +0000
Subject: [PATCH 02/10] pipx preference over pip

---
 src/python/install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index af053759a..012735727 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -878,7 +878,7 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
         else 
-            install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
+            "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' ${util} "setuptools==70.0.0"
         fi
     fi
 

From 836ac2881ad304df20a3c28ca336448408804871 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 08:58:12 +0000
Subject: [PATCH 03/10] mistake correction

---
 src/python/install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index 012735727..ac0127198 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -878,7 +878,7 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
         else 
-            "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' ${util} "setuptools==70.0.0"
+            "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' "setuptools==70.0.0"
         fi
     fi
 

From 7dd40cb4b1a33b5535bd3e8ead20f695ed9894ef Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:08:45 +0000
Subject: [PATCH 04/10] change

---
 src/python/install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index ac0127198..af053759a 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -878,7 +878,7 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
         else 
-            "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' "setuptools==70.0.0"
+            install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
         fi
     fi
 

From 6dd788cfcb789b9968a7f2f1ebf0d05172e32cdf Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:20:28 +0000
Subject: [PATCH 05/10] depending on debian or non-debian, changed code

---
 src/python/install.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index af053759a..93717cc04 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -878,7 +878,19 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
         else 
-            install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
+            if [ "$(grep '^ID=' /etc/os-release | cut -d'=' -f2)" != "debian" ]; then
+                # Check if pipx is installed
+                if ! type pipx > /dev/null 2>&1; then
+                    # Install pipx using pip
+                    pip install pipx
+                    # Add pipx to PATH
+                    export PATH=$PATH:~/.local/bin
+                fi
+                # Install setuptools using pipx
+                "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' "setuptools==70.0.0"
+            else 
+                install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
+            fi
         fi
     fi
 

From 786c2ad225f524ee80179615cec08d8c328fd1a4 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:23:15 +0000
Subject: [PATCH 06/10] misc. change

---
 src/python/install.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index 93717cc04..24b3a9e35 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -886,8 +886,8 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                     # Add pipx to PATH
                     export PATH=$PATH:~/.local/bin
                 fi
-                # Install setuptools using pipx
-                "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' "setuptools==70.0.0"
+                # Install setuptools using pip
+                pip install setuptools==70.0.0
             else 
                 install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
             fi

From 80c8929e70826ebef6c852106d26b4a4fd9eb83a Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:36:57 +0000
Subject: [PATCH 07/10] more changes

---
 src/python/install.sh | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index 24b3a9e35..f10cebe5d 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -886,8 +886,15 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                     # Add pipx to PATH
                     export PATH=$PATH:~/.local/bin
                 fi
-                # Install setuptools using pip
-                pip install setuptools==70.0.0
+                if ! type pipx > /dev/null 2>&1; then
+                    if python_is_externally_managed ${PYTHON_SRC}; then
+                        check_packages pipx
+                        "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' 'setuptools==70.0.0'
+                    else 
+                        # Install setuptools using pip
+                        pip install setuptools==70.0.0
+                    fi
+                fi
             else 
                 install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
             fi

From 0cb6a5fa7b5401a1b98776c86251282176ae1705 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:47:54 +0000
Subject: [PATCH 08/10] in a separate function

---
 src/python/install.sh | 47 +++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index f10cebe5d..501150f7f 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -799,6 +799,30 @@ else
     PYTHON_SRC=$(which python)
 fi
 
+# for vulnerability patching - https://github.com/advisories/GHSA-cx63-2mw6-8hw5
+patch_setuptools() {
+    if [ "$(grep '^ID=' /etc/os-release | cut -d'=' -f2)" != "debian" ]; then
+        # Check if pipx is installed
+        if ! type pipx > /dev/null 2>&1; then
+            # Install pipx using pip
+            pip install pipx
+            # Add pipx to PATH
+            export PATH=$PATH:~/.local/bin
+        fi
+        PIPX_DIR=""
+        if ! type pipx > /dev/null 2>&1; then
+            if python_is_externally_managed ${PYTHON_SRC}; then
+                check_packages pipx
+                "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' 'setuptools==70.0.0'
+            else 
+                pip install setuptools==70.0.0
+            fi
+        fi
+    else 
+        install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
+    fi
+}
+
 # Install Python tools if needed
 if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
     echo 'Installing Python tools...'
@@ -878,27 +902,10 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
         else 
-            if [ "$(grep '^ID=' /etc/os-release | cut -d'=' -f2)" != "debian" ]; then
-                # Check if pipx is installed
-                if ! type pipx > /dev/null 2>&1; then
-                    # Install pipx using pip
-                    pip install pipx
-                    # Add pipx to PATH
-                    export PATH=$PATH:~/.local/bin
-                fi
-                if ! type pipx > /dev/null 2>&1; then
-                    if python_is_externally_managed ${PYTHON_SRC}; then
-                        check_packages pipx
-                        "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' 'setuptools==70.0.0'
-                    else 
-                        # Install setuptools using pip
-                        pip install setuptools==70.0.0
-                    fi
-                fi
-            else 
-                install_user_package "$INSTALL_UNDER_ROOT" "setuptools==70.0.0"
-            fi
+            patch_setuptools
         fi
+    else 
+        patch_setuptools
     fi
 
     rm -rf /tmp/pip-tmp

From 851191bf9d2f346610ba918d30bd64117e00ac20 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:51:43 +0000
Subject: [PATCH 09/10] small change

---
 src/python/install.sh | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index 501150f7f..2b0c90675 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -803,16 +803,11 @@ fi
 patch_setuptools() {
     if [ "$(grep '^ID=' /etc/os-release | cut -d'=' -f2)" != "debian" ]; then
         # Check if pipx is installed
-        if ! type pipx > /dev/null 2>&1; then
-            # Install pipx using pip
-            pip install pipx
-            # Add pipx to PATH
-            export PATH=$PATH:~/.local/bin
-        fi
         PIPX_DIR=""
         if ! type pipx > /dev/null 2>&1; then
             if python_is_externally_managed ${PYTHON_SRC}; then
                 check_packages pipx
+                export PATH=$PATH:~/.local/bin
                 "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' 'setuptools==70.0.0'
             else 
                 pip install setuptools==70.0.0

From 665f0223627299dd5b150b65cfd4ac508717ce67 Mon Sep 17 00:00:00 2001
From: Gaurav Saini <147703805+gauravsaini04@users.noreply.github.com>
Date: Tue, 23 Jul 2024 10:58:01 +0000
Subject: [PATCH 10/10] another change

---
 src/python/install.sh | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/python/install.sh b/src/python/install.sh
index 2b0c90675..c82d54066 100755
--- a/src/python/install.sh
+++ b/src/python/install.sh
@@ -803,12 +803,13 @@ fi
 patch_setuptools() {
     if [ "$(grep '^ID=' /etc/os-release | cut -d'=' -f2)" != "debian" ]; then
         # Check if pipx is installed
+        export PYTHONUSERBASE=/tmp/pip-tmp
+        export PIP_CACHE_DIR=/tmp/pip-tmp/cache
         PIPX_DIR=""
         if ! type pipx > /dev/null 2>&1; then
             if python_is_externally_managed ${PYTHON_SRC}; then
                 check_packages pipx
-                export PATH=$PATH:~/.local/bin
-                "${PIPX_DIR}pipx" install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' 'setuptools==70.0.0'
+                "${PIPX_DIR}pipx" install 'setuptools==70.0.0'
             else 
                 pip install setuptools==70.0.0
             fi
@@ -818,6 +819,8 @@ patch_setuptools() {
     fi
 }
 
+patch_setuptools
+
 # Install Python tools if needed
 if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
     echo 'Installing Python tools...'
@@ -896,11 +899,7 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ -n "${PYTHON_SRC}" ]]; then
                 # cleanup created dir's
                 rm -rf /tmp/setuptools_downloaded /tmp/setuptools_src_dist
             fi
-        else 
-            patch_setuptools
         fi
-    else 
-        patch_setuptools
     fi
 
     rm -rf /tmp/pip-tmp