Add patch 11_reposync_fix_variables to fixup previous security patch

Description: Fix variable usage in reposync

 This error was introduced by 09_reposync-refactor-sanitize-remote_path-usage.patch

 for CVE-2018-10897

Author: Markus Frosch <lazyfrosch@debian.org>

Forwarded: no, upstream has refactored code otherwise

Last-Update: 2019-02-28

---

This patch header follows DEP-3: http://dep.debian.net/deps/dep3/

--- a/reposync.py

+++ b/reposync.py

@@ -322,7 +322,7 @@

             if os.path.exists(local) and os.path.getsize(local) == sz:

                 if not opts.quiet:

-                    my.logger.error("[%s: %-5d of %-5d ] Skipping existing %s" % (repo.id, n, len(download_list), remote))

+                    my.logger.error("[%s: %-5d of %-5d ] Skipping existing %s" % (repo.id, n, len(download_list), pkg.remote_path))

                 continue

             if opts.urls:

@@ -331,7 +331,7 @@

                     baseurl = repo.urls[0] + '/'

                 else:

                     baseurl = repo.urls[0]

-                    url = urljoin(baseurl,remote)

+                    url = urljoin(baseurl,pkg.remote_path)

                     print '%s' % url

                 continue

@@ -347,7 +347,7 @@

             # Disable cache otherwise things won't download            

             repo.cache = 0

             if not opts.quiet:

-                my.logger.info( '[%s: %-5d of %-5d ] Downloading %s' % (repo.id, n, len(download_list), remote))

+                my.logger.info( '[%s: %-5d of %-5d ] Downloading %s' % (repo.id, n, len(download_list), pkg.remote_path))

             pkg.localpath = local # Hack: to set the localpath we want.

             try:

                 path = repo.getPackage(pkg)

@@ -363,11 +363,11 @@

                 result, error = my.sigCheckPkg(pkg)

                 if result != 0:

                     if result == 1:

-                        my.logger.warning('Removing %s, due to missing GPG key.' % os.path.basename(remote))

+                        my.logger.warning('Removing %s, due to missing GPG key.' % os.path.basename(pkg.remote_path))

                     elif result == 2:

-                        my.logger.warning('Removing %s due to failed signature check.' % os.path.basename(remote))

+                        my.logger.warning('Removing %s due to failed signature check.' % os.path.basename(pkg.remote_path))

                     else:

-                        my.logger.warning('Removing %s due to failed signature check: %s' % (os.path.basename(remote), error))

+                        my.logger.warning('Removing %s due to failed signature check: %s' % (os.path.basename(pkg.remote_path), error))

                     os.unlink(path)

                     continue

09_reposync-refactor-sanitize-remote_path-usage.patch

08_print-depsolving-errors-in-yumdownloader.patch

10_yum_conf_path.patch

11_reposync_fix_variables.patch