From ec754808bf34956e994bd158f441203c9c3b08c9 Mon Sep 17 00:00:00 2001
From: Ondrej Nosek <onosek@redhat.com>
Date: Sep 06 2022 14:56:12 +0000
Subject: Fix medium level bandit findings


Fix the rest of the medium level bandit findings. This allows enabling
more strict policy - when a new medium/high level warning appears, tests
will fail.

Additionally, fix new type flake8 issues.

Signed-off-by: Ondrej Nosek <onosek@redhat.com>

---

diff --git a/fedpkg/__init__.py b/fedpkg/__init__.py
index 067867d..1599209 100644
--- a/fedpkg/__init__.py
+++ b/fedpkg/__init__.py
@@ -242,7 +242,7 @@ class Commands(pyrpkg.Commands):
             # Sort the list
             fedoras.sort()
             # Start with the last item, strip the f, add 1, return it.
-            return(int(fedoras[-1].strip('f')) + 1)
+            return int(fedoras[-1].strip('f')) + 1
         else:
             raise pyrpkg.rpkgError('Unable to find rawhide target')
 
diff --git a/fedpkg/cli.py b/fedpkg/cli.py
index 638e557..308bb15 100644
--- a/fedpkg/cli.py
+++ b/fedpkg/cli.py
@@ -1132,7 +1132,7 @@ class fedpkgClient(cliClient):
                 if re.match(RELEASE_BRANCH_REGEX, branch):
                     return '{0} is a current release branch'.format(branch)
                 elif not service_levels:
-                    return'You must provide SLs for non-release branches {0}'.format(branch)
+                    return 'You must provide SLs for non-release branches {0}'.format(branch)
 
         status_message = check_input_parameters()
         if status_message:
@@ -1485,7 +1485,7 @@ class fedpkgClient(cliClient):
                 local_config.add_section(section)
 
             # set the distgit / pagure urls as needed (might already be set)
-            if(token_type == "pagure"):
+            if token_type == "pagure":
                 local_config.set(section, "url", "https://pagure.io/")
             else:
                 local_config.set(section, "apibaseurl", "https://src.fedoraproject.org")
diff --git a/fedpkg/completers.py b/fedpkg/completers.py
index 83427b7..a945a96 100644
--- a/fedpkg/completers.py
+++ b/fedpkg/completers.py
@@ -11,6 +11,7 @@
 # option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
 # the full text of the license.
 
+import os
 import subprocess
 import sys
 
@@ -18,30 +19,55 @@ from argcomplete.completers import ChoicesCompleter
 
 
 def distgit_branches(**kwargs):
-    format = "--format=\"%(refname:short)\""
+    format = "--format=%(refname:short)"
     # TODO: Somehow get $path from argument-string
+    git_remotes = subprocess.Popen(
+        ("git", "for-each-ref", format, "refs/remotes"),
+        stdout=subprocess.PIPE)
     remotes = subprocess.check_output(
-        "git for-each-ref %s 'refs/remotes' | sed 's,.*/,,'" % format,
-        shell=True).decode(sys.stdout.encoding).split()
+        ("sed", "s,.*/,,"),
+        stdin=git_remotes.stdout)
+    git_remotes.wait()
+    git_remotes.stdout.close()
+
     heads = subprocess.check_output(
-        " git for-each-ref %s 'refs/heads'" % format,
-        shell=True).decode(sys.stdout.encoding).split()
-    return remotes + heads
+        ("git", "for-each-ref", format, "refs/heads"))
+
+    return remotes.decode(sys.stdout.encoding).split() \
+        + heads.decode(sys.stdout.encoding).split()
 
 
 def fedpkg_packages(prefix, **kwargs):
     if len(prefix):
-        return subprocess.check_output(
-            "repoquery -C --qf=%{{sourcerpm}} \"{}*\" 2>/dev/null | sed -r "
-            "'s/(-[^-]*){{2}}\\.src\\.rpm$//'"
-            .format(prefix), shell=True).decode(sys.stdout.encoding).split()
+        FNULL = open(os.devnull, 'wb')
+        repoquery = subprocess.Popen(
+            ("repoquery", "-C", "--qf=%{sourcerpm}", "{}*".format(prefix)),
+            stdout=subprocess.PIPE,
+            stderr=FNULL)
+        output = subprocess.check_output(
+            ("sed", "-r", "s/(-[^-]*){2}\\.src\\.rpm$//"),
+            stdin=repoquery.stdout)
+        repoquery.wait()
+        repoquery.stdout.close()
+
+        return tuple(output.decode(sys.stdout.encoding).split())
     else:
         return []
 
 
 def list_targets(**kwargs):
-    return tuple(subprocess.check_output("koji list-targets --quiet 2>/dev/null | cut -d\" \" -f1",
-                                         shell=True).decode(sys.stdout.encoding).split())
+    FNULL = open(os.devnull, 'wb')
+    brew = subprocess.Popen(
+        ("koji", "list-targets", "--quiet"),
+        stdout=subprocess.PIPE,
+        stderr=FNULL)
+    output = subprocess.check_output(
+        ("cut", "-d ", "-f1"),
+        stdin=brew.stdout)
+    brew.wait()
+    brew.stdout.close()
+
+    return tuple(output.decode(sys.stdout.encoding).split())
 
 
 build_arches = ChoicesCompleter(("i386", "i686", "x86_64", "armv5tel",
diff --git a/test/test_retire.py b/test/test_retire.py
index 112e817..ef680c4 100644
--- a/test/test_retire.py
+++ b/test/test_retire.py
@@ -108,7 +108,7 @@ class RetireTestCase(unittest.TestCase):
         client = self._fake_client(args)
         client.log = mock.Mock()
         client.retire()
-        args, kwargs = client.log.warn.call_args
+        args, kwargs = client.log.warning.call_args
         self.assertIn('dead.package found, package or module is already retired',
                       args[0])