update for bug 498544 CVE-2014-0006 and fixing testing

Package-Manager: portage-2.2.7/cvs/Linux x86_64
Manifest-Sign-Key: 0x2471EB3E40AC5AC3

6 files changed, 118 insertions, 22 deletions

diff --git a/sys-cluster/swift/ChangeLog b/sys-cluster/swift/ChangeLog
index 6060c9d7d62c..7dbd395f73f6 100644
--- a/sys-cluster/swift/ChangeLog
+++ b/sys-cluster/swift/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for sys-cluster/swift
 # Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/swift/ChangeLog,v 1.23 2014/01/08 05:59:48 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/swift/ChangeLog,v 1.24 2014/01/20 05:41:12 prometheanfire Exp $
+
+*swift-1.10.0-r1 (20 Jan 2014)
+*swift-1.11.0-r1 (20 Jan 2014)
+
+  20 Jan 2014; Matthew Thode <prometheanfire@gentoo.org>
+  +files/CVE-2014-0006-havana.diff, +files/CVE-2014-0006-master.diff,
+  +swift-1.10.0-r1.ebuild, +swift-1.11.0-r1.ebuild, -swift-1.10.0.ebuild,
+  -swift-1.11.0.ebuild:
+  update for bug 498544 CVE-2014-0006 and fixing testing
 
   08 Jan 2014; Mike Frysinger <vapier@gentoo.org> swift-1.10.0.ebuild,
   swift-1.11.0.ebuild, swift-2013.1.9999.ebuild, swift-2013.2.9999.ebuild,
diff --git a/sys-cluster/swift/Manifest b/sys-cluster/swift/Manifest
index fab827028051..fc4b12d73b50 100644
--- a/sys-cluster/swift/Manifest
+++ b/sys-cluster/swift/Manifest
@@ -2,33 +2,35 @@
 Hash: SHA256
 
 AUX CVE-2013-2161.patch 664 SHA256 728949effcf3669658bb8017f89b1a3a6ed481cc74d2f2c8e4bb235ccde24ba6 SHA512 ac95d6cf50209ffcec48ad16ca730816d5891b4adc2f110bab5974c0d31f3062cb0cc5552f8440b602eb88ed15c78faa30afa9c58c00e05abf2714b5503a7cfd WHIRLPOOL 92db329e49df48745b6401b2fb64963f8548a29dcd530f3449cfe7fa1c38ae05e61fc05bf2250e73c85b295aba4362745faa58c458b5ed80ccce3ea0f0467e7b
+AUX CVE-2014-0006-havana.diff 2400 SHA256 c639027cfe28bba61d6993d506868034c901748858c19666d10541e50a9caadf SHA512 436ddbe29e89eec3d5695b68fa91eb52f4ba6961433a9aeea13d9970e186f087dca35dff500158fddc114925134e3e64a82e13d5f191c84df142e71349e4cfac WHIRLPOOL f27c76330601ee4cb7a230aefd01ca03c0bbe7e0195f9bb78ce952b287dbdc3a360de049838fe159e4363334c230b257cd7f5c959d73a8c68558c244ba0287fd
+AUX CVE-2014-0006-master.diff 1341 SHA256 a43596a5244c99a8ee636e9a3541e8096627fde8c25542213151bfe8af4ef055 SHA512 ff309f6aab878b1e1e9d102f91a84a1a8a75f5150491617f4e4242864858eaf1df2c13fed1210bcfda4c7ebd93ecd2b11adecc52cea75600cec59f6017c83418 WHIRLPOOL 4eaa3c5f41a1f962fe0f1e052db4e92b2b9eb3fa40911f020fbb25fba08c7c799cb3ffe86d751705e687fc6d6e13114b0bd841afaf720d9d6bb63f7d7e7cb056
 AUX swift-account.initd 995 SHA256 f1d4594504b53de480abc69ccb72d37e002ad85118b9d90df12bfda42f4b5faa SHA512 93fcd08508f3efd4d1a75aa51c20b256a0f8c34f9b6ee27501d14376efd7a55e28ffd20fbf91b6406883603fc145e80c39d714b6eaa168fbf4a8c5be7ea63368 WHIRLPOOL ff3c69ad4801d742082dbe7131330b2fb154d1b30c8abfd688234a9f955515c9a1ffceb0ced432b1dd81d375e32e8416fa64b9d45eb199af4cc0ba3aa3c87e1a
 AUX swift-container.initd 1007 SHA256 aba09a5e3396f79c5e49a258c283d37652e182ac62ef8952618ad32b4df1db86 SHA512 1202212955a6a0836abee2c8a2190e359c910037c2f38dbf6874253b21c0739548d9f48c75e3333d0d73376e35c43866b8d0dc38990d4d3b99c04efaab2407c2 WHIRLPOOL d1dc6e468fdd3ab616a53b5357dad09ef089927347a59b95961e7e6b395eec43dedef059fed8eed06f8f324ff0ec7121023953156dcf2266e00dc947aeb8da98
 AUX swift-object.initd 989 SHA256 19a252739dca026435b0a861eea10ff76c22a41ec71d94cc6ce3dddd70b5df58 SHA512 1982f2f76df5d279c51a0a2fd5619dd12a6899559761ac7c0013aa5e5098058430e1a8dcc7cf46d5081bd6dffa17e4223de9b6a85bea4cddaf495b3ca91bacc9 WHIRLPOOL d2a16db387e6d3ff3452854672b5a9c64f03f485d3ddf7e2e67aa51dcb4aa4ab80fd375158dac99943f6c52fefc233cce503be26617110765fc859d82d6b01ab
 AUX swift-proxy.initd 1505 SHA256 8e1ee2051116e869f5e51de426d640c7f57278f1fc2681bd80ec9393fa834c92 SHA512 a030a5b8ceedb69f89fca93abdd08d9f527d2789ed9983f7cca616b4a318176f84913e1d01ed09d5a1a9e55bd0d697d501f5698ea5b3f8ccce7f76b95984dff1 WHIRLPOOL e8653ceb1e19fead4b0941d158661fe6e81d66c71f032aa1be7aa56dd839d43a82adb090a7e509142bfa9a341c49fdf82c8f86e3a9159be63b538b588cca6e66
 DIST swift-1.10.0.tar.gz 660633 SHA256 9a841225c3a00a93a15a160102d3f7116f2f1ba98ebffedfe641747844e14889 SHA512 7531f0c6c06be9a4cc2242a75140845474e176994667b60adb356945c78dfae4993f65dea55789735ac6e5a940353fd5188dab855a0fb91a844c5d26352efa68 WHIRLPOOL 63e7876a61010b3d14ad3b0703a8e1e8601b9824deca1745ac45e840fa9ca212269f5b7f24f2285bd65e2069f09be410d11d71eeac6df4d0204612f8c0f3d6e3
 DIST swift-1.11.0.tar.gz 712263 SHA256 d22767a417bdf9837df194672fc8f1e7eb8499e885f144bd83c865b2f95160c9 SHA512 265ecb5bdf5dedad68a7dd4860333fa81e14f4a16881b8d249ee848c543df5494628ccf917db0fdc37209af7333ecd15fd0faf99d978e097917486b8cb1be7be WHIRLPOOL de118849e0ef1e652368d23c51ebc903c8cd557fc05ab1d35a627576d28563184189c2fe89ed337e88e5d04680fcc323ca0dac1b3f98d762e54f97f2540829e7
-EBUILD swift-1.10.0.ebuild 4001 SHA256 6fa375fd76dd12934dcf63f56659d59cad21da60ac556ca0b6a90db38a630a01 SHA512 61358f17187eeeb2e435d63e527499862a3541d070da126093006601c221b6b8dbe82c9ac16ffa82730c78b61b83bdf033021dbad78e62b8d1f6dd892fc89993 WHIRLPOOL 9f8aaafb7b5b51df7ce7777c42d9242b5433385b3319aa72ce14fa9002e4fcd2abdd14eb51b9a5c18ad9b6a2862e1121089360e28d6f0ba3d6bb0829eaccd0e5
-EBUILD swift-1.11.0.ebuild 4003 SHA256 da6078553c36706799240c54516b0b7c568e2e141921353b01885bed93b1dc5c SHA512 ceeeb03fe0a2291d7cf78ca8745a91bd22a2b26ce5907f53c2a8a7a9ddf0700a09a591c992962c9a21a39054aed0e315e3e5d8a828e83faa408b962a74767421 WHIRLPOOL 8440106da4f7200a85bc00d105c45472e3e842f642b89b9daa883d38b3a4ac001adf20c01914d637d298739dea6449df47612b5b151f3a96b5d66aae2e0e17da
+EBUILD swift-1.10.0-r1.ebuild 4136 SHA256 59d3ca28d26370608950106a1a288f39fc58b24986f177a11e80ae087fcc65a1 SHA512 1803834c9756bb5987547d553802a155803274eb5856f10683005f9b52760271dec2e690d8c4e6e122e1c3a4072c060c12f107b39c72d8e24364cfd3599de68f WHIRLPOOL b9606a1be2f6553f7f094697cf3d2774d691a6466a4470395a81445187b2f59cf72d4a2be0f7d6f0e5411c4c16b80ac95ad60292635e87c495d60c61005564d9
+EBUILD swift-1.11.0-r1.ebuild 4139 SHA256 001684f2add182a100f69b12275598ae6ac0388036a34fdbc711f9ea458de071 SHA512 9dcaa0d93b69c10841465878955e4876537b819fb6d477969192ee40e06e18820b34a1c018d68fcc23615a0389482433f1808a463b493ada840ef3ea4cad02db WHIRLPOOL 29240ce9b05f35686527e84294d0187d6b600dfc4e0ff5cec50f467d73f9d705cb8c59985cf497f23aec8eb30e8a4de59f10756ef3a9818646f59f00d5c79b80
 EBUILD swift-2013.1.9999.ebuild 3979 SHA256 023aed4521192fad79dc572c50f446d9cf05595bbafc89e61ab1e26d25d5d74b SHA512 778270f3350582aee501c60d6195d0b7ba5d2f89e2819e55433f435fb74d42037bc543533092602aeb22c8f3339e5839771b235e02c599f29d438ac6994cd3fc WHIRLPOOL c99af499ccd12b1f9bee44748c16233fa1d197ac7e9c81987dc5367f48b8272b95902f4b35adab2d6b5815108de38abf527e094a2dc9bbec4a21968a92e249f4
 EBUILD swift-2013.2.9999.ebuild 4014 SHA256 3de1990c02c1f41f69c87444e0bf0fcb236a3ed35294ebd6b341c8a652aed127 SHA512 fbc8f06d994609217c6944e02f58a49a0f2c483ed3fa59690eb14a6410c7781d99d0ecdcab0cd4e0de2ecbd80b0836931b4b7112e786a15f5b6e89a6e2448c7d WHIRLPOOL d7ea0b53bdb30ac1b0fafc45a419f129a3e1245ff65804673ddf64f101e310b0769344a2fdfd6240cc094654935bb2425780ef1374c3bce181d285d764346ba6
 EBUILD swift-9999.ebuild 4115 SHA256 e7065fa4019f26a41180adb3074aa02dbb8a7fa88f1d4e3a09eedeb363e083c1 SHA512 88ca4c3bef9ba4a26cf103c89fc72d69618a8e5148d8055b0209585312f9be6edc16c9b6d3988cef482db4df6c9847de1ce2d21f87ad3ec88ddfb24b419e19f2 WHIRLPOOL aa7525858153ad4107115841b035d2c6cc321eadbfe2f500c0e1e180e5c609267628f9ac309e0cc8a62aeaee9fda477e20d8376b878ca2dcff76e17bb3b376a0
-MISC ChangeLog 4498 SHA256 ec48033ed3e73830682136e8e4c2708b7c475a32cf3bcb66ab4a1f0eae042227 SHA512 3aa435cfb483e88b61e93edf4dd15f5b3f1ded054ee933880daf64a82783a66386f61ddfbd219b25fdd250af3b7fa31e53e5e4c13cb037eeb2c8aa93da8f98d4 WHIRLPOOL b7681d9baf62ed37e9d0a68189707d20104c8913032cb4f3a4b0adfe4b98c90b40f106a6a4ca519e9fa8e70cb904ddf5b6354d46bf5a3304087b87f5db4cf70c
+MISC ChangeLog 4852 SHA256 18e2079037c2c69b0152ea414e4b9e5843dff4943cca2765760dd86f0af6576e SHA512 4df1c387ac7153e74b9aa04ae00c75707a46e0450e04c597e58f300f77d35e8990de5d96e8327f4bf352bacfe79b4b65505e3a77847ebebf425ca878bb4e202a WHIRLPOOL 52b0ab65db280acc11ff849b35e721e3083f72cdc91807ccc5a560c4a1d0711fcef0fda4c94526bad22c93fd4ecfecb259051e00cf0bbd788bc942bfe1fff926
 MISC metadata.xml 719 SHA256 319a1a58e687f433d3fbbc742d13c046dae70211fcf1b81a60d2acb69580c0ec SHA512 029f6557fa226e698e7070a9ee1d445adde992f9b44a219b5be80035d14dbab1daa61d9ad53ae52917a93d7689a0bfd1b0ca8f99e787d6beed9e601d459ea257 WHIRLPOOL da64649598a4601918d5f3932600105de0f8f5c3aa80acca697a7155115a18b562cad8dc068272931907ab4300b55219daec8bbe897a34363c0e9d1700967159
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
-iQIcBAEBCAAGBQJSzOldAAoJEPGu1DbS6WIAkcIP/iGt10dcmaDDfQq0wkCirgYW
-sG2ZCoZXHq/Tbxpw4EMlXe5FNZ7tLA8sMU5qMGsH9/nC7hqXxKAHX53vFIEIkLY/
-t3EKHxbZ4Ru5M1IEgcQYOgAj21qX0AxYoLB9tF7dR4YdxHipJ1uCEdACUmyjvbS6
-DNwi3HUfe3F/v1TCZcv/DcB5UmY2LVyw1rMuhRc9Bywu5IQKeOUotX5yFrnpaQ9z
-+0G/4Pw0wUTY08yNStRuV5ScYyy1RjOJC97m2/Z749JYgGm4BJqOk2/daAuDZZSv
-Tf2QV5MQMTLnGDA5ZtbfKMtaH5D4ZEEW0s1S6kbtQoVUm3d7LKFYuf30L8I78+Ea
-JcTZ4uDAXs3rgQgBMOzVWCE9FQZFakyoHc9BJP62QNdL53NjMzGvCFp6E+O1JI6b
-2OwZZY815Pq3g6CBxx0UAbYuxXOF9n3NC3YE7SXO5Yrj8TRARQd0HB7t3YPJD7pk
-ePibhf1b921RKTtciPnEAFAWYFYLvMQQGgCYDG+Rzyg3CwLuh3M8izvwVQhcJbqH
-lxk6P+japcFzfRslcm29nf9py04A9GPl33H5MiRIxM8B4X/coIQLsr2vH3gVA9l5
-ZN4EVIyw9a0ic9Q4Pj87jT7OH/0IMhGU1NaS4psDyICaCm9sBgpcDouoVJUwcCKa
-U7wNq1q112+ccnidVu6+
-=sNoO
+iQIcBAEBCAAGBQJS3Lc2AAoJECRx6z5ArFrDHksQAJsHVQen3Xc3lmi2/oW8KYIZ
+rk1q+IALwqfQRvE4qNxlbdGZT8wB+B2M0sYDCjt4XrbHoDoIapWXTDX2yGdpIi9E
+12J16S81WeaXjMbyAozgxHRC6F/QYHWGedN0SHpHWNPjB5xOqOfM30J5Lj3KI3T2
+pCEQffVjUFyBXr2vyXqq0yFM3tSlD74hD7O90If5mVpelrKH51kz2Jwl0AHrh/Gw
+RamBmpQ41bdXBInuqLISDNShGIPYgGPNvcyKWw7rrVtXAlI04lDTjpcN5hXfn+En
+Iez/OV3uE0621+EXbUj3LjklNzTji7sTb5xVnN2Gfn8AGBNrJ2L0FezrEHgj6BwM
+n2mOoBrymquJXlofi1cJQOup5rwJenB3X7wUpO9ZBn7LiutHShqpD2F6SKm7K1o8
+h/yk9B6f+//ulO6FEDIaOk4+Md3aL1yTK5zovnhG5pRIW5f91M/P66MqCEGiscMq
+UzRrhrfXqiDj8vm4DQVNpw0eDTPo6yvWVxrPwoA0CODOIq1d3A0Idgpl9FLnqEqr
+Ju7psNsWcGpBOiXyXMTCVmRca+XCfoUeKdrvCSPKHe4izLz0pBxXvk7viMcRmEL9
+mazCVwMF4fMxsn9AC2e6VDMYCAWfFnbWnCAk0CHadC49vvY2TNt7Y9BpUmHK2AAV
+XrW9cQcmX8t9UOlZB//3
+=6S0A
 -----END PGP SIGNATURE-----
diff --git a/sys-cluster/swift/files/CVE-2014-0006-havana.diff b/sys-cluster/swift/files/CVE-2014-0006-havana.diff
new file mode 100644
index 000000000000..e0c0634f6e1c
--- /dev/null
+++ b/sys-cluster/swift/files/CVE-2014-0006-havana.diff
@@ -0,0 +1,51 @@
+commit 6c378b4b65524ea3b485c47d829ed0aebbdb86c0
+Author: Samuel Merritt <sam@swiftstack.com>
+Date:   Fri Jan 3 09:26:11 2014 -0800
+
+    Backported tempurl const time compare for 1.10.0
+    
+    Change-Id: I6db8f9a568dab8403ed74a83ba0c9548f06425e1
+
+diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py
+index ffc1431..ae2f4a1 100644
+--- a/swift/common/middleware/tempurl.py
++++ b/swift/common/middleware/tempurl.py
+@@ -98,7 +98,7 @@ from urlparse import parse_qs
+ 
+ from swift.proxy.controllers.base import get_account_info
+ from swift.common.swob import HeaderKeyDict
+-from swift.common.utils import split_path
++from swift.common.utils import split_path, streq_const_time
+ 
+ 
+ #: Default headers to remove from incoming requests. Simply a whitespace
+@@ -267,17 +267,20 @@ class TempURL(object):
+         if not keys:
+             return self._invalid(env, start_response)
+         if env['REQUEST_METHOD'] == 'HEAD':
+-            hmac_vals = self._get_hmacs(env, temp_url_expires, keys,
+-                                        request_method='GET')
+-            if temp_url_sig not in hmac_vals:
+-                hmac_vals = self._get_hmacs(env, temp_url_expires, keys,
+-                                            request_method='PUT')
+-                if temp_url_sig not in hmac_vals:
+-                    return self._invalid(env, start_response)
++            hmac_vals = (self._get_hmacs(env, temp_url_expires, keys,
++                                         request_method='GET') +
++                         self._get_hmacs(env, temp_url_expires, keys,
++                                         request_method='PUT'))
+         else:
+             hmac_vals = self._get_hmacs(env, temp_url_expires, keys)
+-            if temp_url_sig not in hmac_vals:
+-                return self._invalid(env, start_response)
++
++        # While it's true that any() will short-circuit, this doesn't affect
++        # the timing-attack resistance since the only way this will
++        # short-circuit is when a valid signature is passed in.
++        is_valid_hmac = any(streq_const_time(temp_url_sig, h)
++                            for h in hmac_vals)
++        if not is_valid_hmac:
++            return self._invalid(env, start_response)
+         self._clean_incoming_headers(env)
+         env['swift.authorize'] = lambda req: None
+         env['swift.authorize_override'] = True
diff --git a/sys-cluster/swift/files/CVE-2014-0006-master.diff b/sys-cluster/swift/files/CVE-2014-0006-master.diff
new file mode 100644
index 000000000000..bf545908434b
--- /dev/null
+++ b/sys-cluster/swift/files/CVE-2014-0006-master.diff
@@ -0,0 +1,28 @@
+diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py
+index c9b9d94..5748694 100644
+--- a/swift/common/middleware/tempurl.py
++++ b/swift/common/middleware/tempurl.py
+@@ -106,7 +106,7 @@ from urlparse import parse_qs
+ from swift.proxy.controllers.base import get_account_info
+ from swift.common.swob import HeaderKeyDict, HTTPUnauthorized
+ from swift.common.utils import split_path, get_valid_utf8_str, \
+-    register_swift_info, get_hmac
++    register_swift_info, get_hmac, streq_const_time
+ 
+ 
+ #: Default headers to remove from incoming requests. Simply a whitespace
+@@ -284,7 +284,13 @@ class TempURL(object):
+                                 request_method='PUT'))
+         else:
+             hmac_vals = self._get_hmacs(env, temp_url_expires, keys)
+-        if temp_url_sig not in hmac_vals:
++
++        # While it's true that any() will short-circuit, this doesn't affect
++        # the timing-attack resistance since the only way this will
++        # short-circuit is when a valid signature is passed in.
++        is_valid_hmac = any(streq_const_time(temp_url_sig, hmac)
++                            for hmac in hmac_vals)
++        if not is_valid_hmac:
+             return self._invalid(env, start_response)
+         self._clean_incoming_headers(env)
+         env['swift.authorize'] = lambda req: None
diff --git a/sys-cluster/swift/swift-1.10.0.ebuild b/sys-cluster/swift/swift-1.10.0-r1.ebuild
index 1747ea78b10f..6e44a87e9042 100644
--- a/sys-cluster/swift/swift-1.10.0.ebuild
+++ b/sys-cluster/swift/swift-1.10.0-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2014 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/swift/swift-1.10.0.ebuild,v 1.4 2014/01/08 05:59:48 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/swift/swift-1.10.0-r1.ebuild,v 1.1 2014/01/20 05:41:12 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -49,6 +49,8 @@ CONFIG_CHECK="~EXT3_FS_XATTR ~SQUASHFS_XATTR ~CIFS_XATTR ~JFFS2_FS_XATTR
 ~TMPFS_XATTR ~UBIFS_FS_XATTR ~EXT2_FS_XATTR ~REISERFS_FS_XATTR ~EXT4_FS_XATTR
 ~ZFS"
 
+PATCHES=( "${FILESDIR}/CVE-2014-0006-havana.diff" )
+
 pkg_setup() {
 	enewuser swift
 	enewgroup swift
@@ -57,12 +59,13 @@ pkg_setup() {
 src_prepare() {
 	sed -i 's/xattr/pyxattr/g' "${S}/swift.egg-info/requires.txt"
 	sed -i 's/xattr/pyxattr/g' "${S}/requirements.txt"
+	distutils-r1_python_prepare_all
 }
 
 src_test () {
 	# https://bugs.launchpad.net/swift/+bug/1249727
 	find . \( -name test_wsgi.py -o -name test_locale.py \) -delete || die
-	sh .unittests || die
+	SKIP_PIP_INSTALL=1 PBR_VERSION=0.5.23 sh .unittests || die
 }
 
 python_install() {
diff --git a/sys-cluster/swift/swift-1.11.0.ebuild b/sys-cluster/swift/swift-1.11.0-r1.ebuild
index 8800b9f22215..b2bc8d26c74c 100644
--- a/sys-cluster/swift/swift-1.11.0.ebuild
+++ b/sys-cluster/swift/swift-1.11.0-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2014 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/swift/swift-1.11.0.ebuild,v 1.2 2014/01/08 05:59:48 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/swift/swift-1.11.0-r1.ebuild,v 1.1 2014/01/20 05:41:12 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -49,6 +49,8 @@ CONFIG_CHECK="~EXT3_FS_XATTR ~SQUASHFS_XATTR ~CIFS_XATTR ~JFFS2_FS_XATTR
 ~TMPFS_XATTR ~UBIFS_FS_XATTR ~EXT2_FS_XATTR ~REISERFS_FS_XATTR ~EXT4_FS_XATTR
 ~ZFS"
 
+PATCHES=( "${FILESDIR}/CVE-2014-0006-master.diff" )
+
 pkg_setup() {
 	enewuser swift
 	enewgroup swift
@@ -57,12 +59,13 @@ pkg_setup() {
 src_prepare() {
 	sed -i 's/xattr/pyxattr/g' "${S}/swift.egg-info/requires.txt"
 	sed -i 's/xattr/pyxattr/g' "${S}/requirements.txt"
+	distutils-r1_python_prepare_all
 }
 
 src_test () {
 	# https://bugs.launchpad.net/swift/+bug/1249727
 	find . \( -name test_wsgi.py -o -name test_locale.py \) -delete || die
-	sh .unittests || die
+	SKIP_PIP_INSTALL=1 PBR_VERSION=0.5.23 sh .unittests || die
 }
 
 python_install() {
@@ -71,7 +74,7 @@ python_install() {
 	insinto /etc/swift
 
 	newins "etc/swift.conf-sample" "swift.conf"
-	newins "etc/swift-bench.conf-sample" "swift-bench.conf-sample"
+#	newins "etc/swift-bench.conf-sample" "swift-bench.conf-sample"
 	newins "etc/rsyncd.conf-sample" "rsyncd.conf"
 	newins "etc/mime.types-sample" "mime.types-sample"
 	newins "etc/memcache.conf-sample" "memcache.conf-sample"