Adding metadata

3 files changed, 3 insertions, 87 deletions

diff --git a/dev-python/tornado/Manifest b/dev-python/tornado/Manifest
index ae3555d3588a..7fcffa153f4c 100644
--- a/dev-python/tornado/Manifest
+++ b/dev-python/tornado/Manifest
@@ -1,4 +1,4 @@
-DIST tornado-6.5.7.tar.gz 519252 BLAKE2B 7d2a2f265de1137c632bf222dc8e8e65efe9328c7c82af5741e069be1dae34de33547a93844518c213ca131d064d87db1d438145e47cfc0da4ddb4485bad9a33 SHA512 bd9790da5dc84580710cc74cda0f8f691ff0af845e9e4b47c431333aae5107d808f8a3a82155d4cddefb86f4c516f3a2bef15edcb19d743b936d20d101db7cf1
-DIST tornado-6.5.7.tar.gz.provenance 9369 BLAKE2B 4893e0653f2c39d9aa89a2a7c888860aad829f255394308f11de1a2ece80a00cf479270427cf833720e524d91b42926645f63f2867a4a441b6273b7e4722a076 SHA512 3e97725d8964764cab43f4750d88843394a0577d54e6529e13de5ab55e5898f4853e59bbe973c813e7c05c67e4c9f472e3569f6e934559b9a9bcb71cd38dbcc6
 DIST tornado-6.5.8.tar.gz 520493 BLAKE2B e48ca20fe0551b8536162071e0b9267ccd167df617c25f930481668e733c656904109014e65462e561d47acc557cfe32f86a422e8f7e840b4262acbafb2b720a SHA512 88c096ca30357644c07b6013cd514b5e64135b26a77d9ff17640951632d6f68c9a68d7fa80224743f7900fbf5ddde838088bd9838395651d87d876c8d1d1a2fe
 DIST tornado-6.5.8.tar.gz.provenance 9416 BLAKE2B 1f4d1d9289f8aa8fdde1dda19454da15e9056111f0225e0701eb385ef42b0fae26a6bb9dc5df3ffb9796e4d805db5aa7406aa466ec9389802df1033cdb5231a6 SHA512 b1c364aed55ecb3cbab7343de9ebfaa181579ca81a57e498953c7d0e657bd8b08ee9fb6e5f72d8205f379fbd25237054bfecdb9982fc973e4bb55a00a0411444
+DIST tornado-6.5.9.tar.gz 536145 BLAKE2B 13071c50a8f0701d750f26aa5fb3669ee5c78c4d249d570b519a672d8fdfa76d38f90633ad21fa1c7d551c50c5f6d0dab53ebb694685d52f1cc1269cb0728564 SHA512 e497f0cacca0ca0d34b65117a72e9ebe0056f77ced09eb5d200dea24da8c28182d5704d1b17510fc139841718fce6a19c7f154d416e59292f4236eb717a0a75c
+DIST tornado-6.5.9.tar.gz.provenance 9473 BLAKE2B 9c58b5c0753dee0f9e111cd5007512fffc91964cad3eeed7e11758aff96f239692492f35f220f08ef10bfd249013d3d1c550a4f79a3669c86abd5ef5fd2922a7 SHA512 20cb384accabf2c8659f90446c2f39d3b3535662114e0707521a870e291879da15a8c6c0fac61a6e64a26e4f64ccfc8d8f1dd3db60717b3121a52263422fb061
diff --git a/dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch b/dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch
deleted file mode 100644
index 4bc9ebd46c69..000000000000
--- a/dev-python/tornado/files/tornado-6.5.7-pycurl-7.47.0.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 9648c5892c232fd7b02b9ad80d2bbe09ac38edb3 Mon Sep 17 00:00:00 2001
-From: Claude <noreply@anthropic.com>
-Date: Sat, 4 Jul 2026 19:10:59 +0000
-Subject: [PATCH] Fix test_strip_headers_on_redirect's URL-embedded-credentials
- cases
-
-url.replace("http://", ...) replaced every occurrence of "http://" in
-the fetched URL, including the one inside the "url" query parameter
-that RedirectHandler uses as the redirect target. That accidentally
-embedded the test credentials in the Location header's URL too, so
-the "different origin" subtest was actually exercising "does libcurl
-honor credentials the server explicitly put in the redirect target"
-rather than "does libcurl strip credentials carried over from the
-original request" - libcurl correctly does the former, which is not
-a credential leak.
-
-Limit the replacement to the first occurrence so only the outer,
-fetched URL carries the test credentials.
-
-Separately, the "same origin" subtest for this case now surfaces an
-actual libcurl regression (still present in curl's git master as of
-this writing): credentials embedded in the URL are dropped across a
-same-origin redirect when the Location header is an absolute URL
-(a relative Location correctly preserves them). This isn't a security
-issue since nothing leaks to another origin, so that specific
-assertion is skipped rather than asserted either way.
----
- tornado/test/httpclient_test.py | 29 ++++++++++++++++++++++-------
- 1 file changed, 22 insertions(+), 7 deletions(-)
-
-diff --git a/tornado/test/httpclient_test.py b/tornado/test/httpclient_test.py
-index 64e5cc5ff..1540ac3c2 100644
---- a/tornado/test/httpclient_test.py
-+++ b/tornado/test/httpclient_test.py
-@@ -785,7 +785,12 @@ def test_strip_headers_on_redirect(self):
-                     "/redirect?url=%s&status=302" % self.get_url2("/echo_headers")
-                 )
-                 if url_creds:
--                    url = url.replace("http://", "http://%s@" % url_creds)
-+                    # Only add credentials to the outer URL being fetched, not to the
-+                    # "url" query parameter (the redirect target), which also starts
-+                    # with "http://". Otherwise the redirect's Location header would
-+                    # carry its own explicit credentials for the new origin, which
-+                    # libcurl legitimately honors instead of stripping.
-+                    url = url.replace("http://", "http://%s@" % url_creds, 1)
-                 response = self.fetch(**dict(path=url) | kwargs)
-                 response.rethrow()
-                 echoed_headers = json_decode(response.body)
-@@ -799,17 +804,27 @@ def test_strip_headers_on_redirect(self):
-                     "/redirect?url=%s&status=302" % self.get_url("/echo_headers")
-                 )
-                 if url_creds:
--                    url = url.replace("http://", "http://%s@" % url_creds)
-+                    url = url.replace("http://", "http://%s@" % url_creds, 1)
-                 response = self.fetch(**dict(path=url) | kwargs)
-                 response.rethrow()
-                 echoed_headers = json_decode(response.body)
-                 # Confirm that non-auth headers are getting through
-                 self.assertIn("User-Agent", echoed_headers)
--                # Auth headers are not stripped when the redirect is same-origin.
--                # Each of our tests uses one of these headers, but not both.
--                self.assertTrue(
--                    "Authorization" in echoed_headers or "Cookie" in echoed_headers
--                )
-+                if name == "credentials in URL":
-+                    # Some libcurl versions (known regression as of 8.20/8.21,
-+                    # still present as of curl's git master) drop credentials
-+                    # embedded in the URL across a same-origin redirect whose
-+                    # Location header is an absolute URL, even though they
-+                    # should be preserved. This isn't a security concern
-+                    # (nothing is leaked to another origin), so just don't
-+                    # assert on it either way here.
-+                    pass
-+                else:
-+                    # Auth headers are not stripped when the redirect is same-origin.
-+                    # Each of our tests uses one of these headers, but not both.
-+                    self.assertTrue(
-+                        "Authorization" in echoed_headers or "Cookie" in echoed_headers
-+                    )
- 
- 
- class RequestProxyTest(unittest.TestCase):
diff --git a/dev-python/tornado/tornado-6.5.7.ebuild b/dev-python/tornado/tornado-6.5.9.ebuild
index ed2542ccdd51..34eff013d738 100644
--- a/dev-python/tornado/tornado-6.5.7.ebuild
+++ b/dev-python/tornado/tornado-6.5.9.ebuild
@@ -20,7 +20,7 @@ HOMEPAGE="
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
@@ -38,8 +38,6 @@ BDEPEND="
 
 PATCHES=(
 	"${FILESDIR}/${PN}-6.3.2-ignore-deprecationwarning.patch"
-	# https://github.com/tornadoweb/tornado/pull/3678
-	"${FILESDIR}/${P}-pycurl-7.47.0.patch"
 )
 
 src_prepare() {