6 files changed, 63 insertions, 159 deletions
diff --git a/dev-python/imageio/Manifest b/dev-python/imageio/Manifest
index 3251bc1377d8..ae59f0904f03 100644
--- a/dev-python/imageio/Manifest
+++ b/dev-python/imageio/Manifest
@@ -1,4 +1,3 @@
-DIST imageio-2.21.0.gh.tar.gz 391056 BLAKE2B 90fbacf7b396ab2b422d8694274ddc3642c92cfd325bce2861100f5bd28d82120cef6819b53b8ed82ba474d5e287765b63da9a7edfbfab5a026790a39d4edc1e SHA512 5bb070da560ba3a2e10bdb288ad539274ee14f8cf0543847859f0bae052b3d1782777d823435b74120bcfdff0b6cb15a6c80b2a9bf729439bbb3802f15cf5684
-DIST imageio-2.21.1.gh.tar.gz 391159 BLAKE2B 4c569ec81255d1f5985d2d30f303a978f9cb22e0d7368845648ddab9e5734adba52173d42ad73c94c424ce1a5806c3a10ae31381b04949f7f8c30fd327b585b4 SHA512 61fd4a1a64fb152fa5c419cac9a69ea979ac762fbaed81076ddd13602db98f71f31825615111958f21b021213d55be060197417159022bba84d631618f5bb286
-DIST imageio-2.21.2.gh.tar.gz 392425 BLAKE2B 959c89627188aca0072f519f0f9c3a9fcf2da96883f95760375bea503efd96ff6a198ad7e8bc12dfffe6aecf42f4b07176c8d273c6d349b5e2581053ddefecb6 SHA512 69922f05457f050083e92dbce34992911d5fb04f283d6784a8e1fd7f10e7887ffeef343d8f4162efaa55690f363ed6ceb5d2cdc5ee712ae9b276f072fdc45d37
 DIST imageio-2.22.0.gh.tar.gz 394144 BLAKE2B 957edbeaad6be459ff865eed3159b0f7776e3dd0782e0380bfe2c40362d0c08ccc8f29a2f38a8427deb263554495b73cc4df641e569b9d33700fcc6ed1395396 SHA512 23d606e32ab2bdc306a4b9d17120e5eda8c8a4fd96d840181afecd6e35f6649621740608f0286d2a5462822acc7ef4e1e7f1e9076882ce975f1da717b136c8c4
+DIST imageio-chelsea.png 221294 BLAKE2B 58537d7a1678fa5be4cc899e5bacd925bfc180eb4ae691330a53749a49ff544e979609b529ed27e5c1fc9efe4bc050ca1ce49b777f4016fb1d66affd926ef9d3 SHA512 48470cdb843eed4dfa6673811c09c5aac9869ee23dd36be0c6b653d9f108d61d21b148c2a4435aaa6604887ba030e5bbc5e35d378da876366445dfc2d0ba4e27
+DIST imageio-cockatoo.mp4 728751 BLAKE2B 45b22cd517c1cb7c0cd12f8865facaca6a847047aea716e49633cf2b1dc13826f94787c8a8f9dd5f48c6a896f5d37794c0058da1bde9e1469f196916476dbfa2 SHA512 e9cb7c25de8019c59ba4090cf10ab29f2b5d62ada37a877081ca07d2ecfe010036222ae843b41bbcc843130d97fa5e14421de252639e9481df1d1c27b19add49
diff --git a/dev-python/imageio/files/imageio-2.22.0-block-download.patch b/dev-python/imageio/files/imageio-2.22.0-block-download.patch
new file mode 100644
index 000000000000..ba483813b23c
--- /dev/null
+++ b/dev-python/imageio/files/imageio-2.22.0-block-download.patch
@@ -0,0 +1,32 @@
+From 1ae48cfa95e84cb064edc74a4a64bd0f7dee780a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Tue, 4 Oct 2022 09:40:42 +0200
+Subject: [PATCH] Unconditionally disable downloading binaries from Internet
+
+Bug: https://bugs.gentoo.org/874849
+---
+ imageio/core/fetching.py | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/imageio/core/fetching.py b/imageio/core/fetching.py
+index 0380bc7..70f1a3d 100644
+--- a/imageio/core/fetching.py
++++ b/imageio/core/fetching.py
+@@ -97,11 +97,10 @@ def get_remote_file(fname, directory=None, force_download=False, auto=True):
+                     break
+ 
+     # If we get here, we're going to try to download the file
+-    if os.getenv("IMAGEIO_NO_INTERNET", "").lower() in ("1", "true", "yes"):
++    if True:
+         raise InternetNotAllowedError(
+-            "Will not download resource from the "
+-            "internet because environment variable "
+-            "IMAGEIO_NO_INTERNET is set."
++            "Implicit insecure downloads disabled on Gentoo due to security "
++            "concerns.  See https://bugs.gentoo.org/874849."
+         )
+ 
+     # Can we proceed with auto-download?
+-- 
+2.38.0
+
diff --git a/dev-python/imageio/imageio-2.21.1.ebuild b/dev-python/imageio/imageio-2.21.1.ebuild
deleted file mode 100644
index 65cad728e477..000000000000
--- a/dev-python/imageio/imageio-2.21.1.ebuild
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{7,8,9,10} )
-
-inherit distutils-r1
-
-DESCRIPTION="Python library for reading and writing image data"
-HOMEPAGE="
-	https://imageio.readthedocs.io/en/stable/
-	https://github.com/imageio/imageio/
-	https://pypi.org/project/imageio/
-"
-SRC_URI="
-	https://github.com/imageio/imageio/archive/v${PV}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-# over 50% of tests rely on Internet
-PROPERTIES="test_network"
-RESTRICT="test"
-
-RDEPEND="
-	>=dev-python/numpy-1.20.0[${PYTHON_USEDEP}]
-	>=dev-python/pillow-8.3.2[${PYTHON_USEDEP}]
-	media-libs/freeimage
-"
-# requests for fsspec[github]
-BDEPEND="
-	test? (
-		dev-python/fsspec[${PYTHON_USEDEP}]
-		dev-python/imageio-ffmpeg[${PYTHON_USEDEP}]
-		dev-python/psutil[${PYTHON_USEDEP}]
-		dev-python/requests[${PYTHON_USEDEP}]
-		dev-python/tifffile[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-EPYTEST_DESELECT=(
-	# Fails because of system installed freeimage
-	tests/test_core.py::test_findlib2
-	# Tries to download ffmpeg binary ?!
-	tests/test_ffmpeg.py::test_get_exe_installed
-)
diff --git a/dev-python/imageio/imageio-2.21.2.ebuild b/dev-python/imageio/imageio-2.21.2.ebuild
deleted file mode 100644
index 65cad728e477..000000000000
--- a/dev-python/imageio/imageio-2.21.2.ebuild
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{7,8,9,10} )
-
-inherit distutils-r1
-
-DESCRIPTION="Python library for reading and writing image data"
-HOMEPAGE="
-	https://imageio.readthedocs.io/en/stable/
-	https://github.com/imageio/imageio/
-	https://pypi.org/project/imageio/
-"
-SRC_URI="
-	https://github.com/imageio/imageio/archive/v${PV}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-# over 50% of tests rely on Internet
-PROPERTIES="test_network"
-RESTRICT="test"
-
-RDEPEND="
-	>=dev-python/numpy-1.20.0[${PYTHON_USEDEP}]
-	>=dev-python/pillow-8.3.2[${PYTHON_USEDEP}]
-	media-libs/freeimage
-"
-# requests for fsspec[github]
-BDEPEND="
-	test? (
-		dev-python/fsspec[${PYTHON_USEDEP}]
-		dev-python/imageio-ffmpeg[${PYTHON_USEDEP}]
-		dev-python/psutil[${PYTHON_USEDEP}]
-		dev-python/requests[${PYTHON_USEDEP}]
-		dev-python/tifffile[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-EPYTEST_DESELECT=(
-	# Fails because of system installed freeimage
-	tests/test_core.py::test_findlib2
-	# Tries to download ffmpeg binary ?!
-	tests/test_ffmpeg.py::test_get_exe_installed
-)
diff --git a/dev-python/imageio/imageio-2.21.0.ebuild b/dev-python/imageio/imageio-2.22.0-r1.ebuild
index 65cad728e477..10601f5a0811 100644
--- a/dev-python/imageio/imageio-2.21.0.ebuild
+++ b/dev-python/imageio/imageio-2.22.0-r1.ebuild
@@ -8,6 +8,7 @@ PYTHON_COMPAT=( python3_{7,8,9,10} )
 
 inherit distutils-r1
 
+BIN_COMMIT=224074bca448815e421a59266864c23041531a42
 DESCRIPTION="Python library for reading and writing image data"
 HOMEPAGE="
 	https://imageio.readthedocs.io/en/stable/
@@ -17,6 +18,12 @@ HOMEPAGE="
 SRC_URI="
 	https://github.com/imageio/imageio/archive/v${PV}.tar.gz
 		-> ${P}.gh.tar.gz
+	test? (
+		https://github.com/imageio/imageio-binaries/raw/${BIN_COMMIT}/images/chelsea.png
+			-> ${PN}-chelsea.png
+		https://github.com/imageio/imageio-binaries/raw/${BIN_COMMIT}/images/cockatoo.mp4
+			-> ${PN}-cockatoo.mp4
+	)
 "
 
 LICENSE="MIT"
@@ -44,9 +51,31 @@ BDEPEND="
 
 distutils_enable_tests pytest
 
+src_prepare() {
+	local PATCHES=(
+		# block silently downloading vulnerable libraries from the Internet
+		"${FILESDIR}"/imageio-2.22.0-block-download.patch
+	)
+
+	if use test; then
+		mkdir -p "${HOME}"/.imageio/images || die
+		local i
+		for i in chelsea.png cockatoo.mp4; do
+			cp "${DISTDIR}/${PN}-${i}" "${HOME}/.imageio/images/${i}" || die
+		done
+	fi
+
+	distutils-r1_src_prepare
+}
+
 EPYTEST_DESELECT=(
 	# Fails because of system installed freeimage
 	tests/test_core.py::test_findlib2
 	# Tries to download ffmpeg binary ?!
 	tests/test_ffmpeg.py::test_get_exe_installed
+	# blocked by our patch
+	tests/test_core.py::test_fetching
+	tests/test_core.py::test_request
+	# removed upstream
+	tests/test_pillow.py::test_png_remote
 )
diff --git a/dev-python/imageio/imageio-2.22.0.ebuild b/dev-python/imageio/imageio-2.22.0.ebuild
deleted file mode 100644
index 65cad728e477..000000000000
--- a/dev-python/imageio/imageio-2.22.0.ebuild
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{7,8,9,10} )
-
-inherit distutils-r1
-
-DESCRIPTION="Python library for reading and writing image data"
-HOMEPAGE="
-	https://imageio.readthedocs.io/en/stable/
-	https://github.com/imageio/imageio/
-	https://pypi.org/project/imageio/
-"
-SRC_URI="
-	https://github.com/imageio/imageio/archive/v${PV}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-# over 50% of tests rely on Internet
-PROPERTIES="test_network"
-RESTRICT="test"
-
-RDEPEND="
-	>=dev-python/numpy-1.20.0[${PYTHON_USEDEP}]
-	>=dev-python/pillow-8.3.2[${PYTHON_USEDEP}]
-	media-libs/freeimage
-"
-# requests for fsspec[github]
-BDEPEND="
-	test? (
-		dev-python/fsspec[${PYTHON_USEDEP}]
-		dev-python/imageio-ffmpeg[${PYTHON_USEDEP}]
-		dev-python/psutil[${PYTHON_USEDEP}]
-		dev-python/requests[${PYTHON_USEDEP}]
-		dev-python/tifffile[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-EPYTEST_DESELECT=(
-	# Fails because of system installed freeimage
-	tests/test_core.py::test_findlib2
-	# Tries to download ffmpeg binary ?!
-	tests/test_ffmpeg.py::test_get_exe_installed
-)