Hardening backport differences from dev present in 16.10 but not 16.07

config/plugins/webhooks/demo/phdcomics/helper/__init__.py

@@ -1,7 +1,7 @@
-import urllib
-import re
-import random
 import logging
+import random
+import re
+import urllib
 
 log = logging.getLogger(__name__)
 

lib/galaxy/tools/deps/conda_compat.py

@@ -61,7 +61,7 @@ def _render_jinja2(recipe_dir):
 
 @_Memoized
 def yamlize(data):
-    res = yaml.load(data)
+    res = yaml.safe_load(data)
     # ensure the result is a dict
     if res is None:
         res = {}

lib/galaxy/tools/deps/container_resolvers/mulled.py

@@ -2,13 +2,13 @@
 
 import collections
 import logging
+import subprocess
 
 from ..container_resolvers import (
     ContainerResolver,
 )
 from ..docker_util import build_docker_images_command
 from ..mulled.mulled_build import (
-    check_output,
     DEFAULT_CHANNELS,
     ensure_installed,
     InvolucroContext,
@@ -33,9 +33,9 @@ CachedMulledImageMultiTarget.multi_target = True
 
 
 def list_cached_mulled_images(namespace=None):
-    command = build_docker_images_command(truncate=True, sudo_docker=False)
-    command = "%s | tail -n +2 | tr -s ' ' | cut -d' ' -f1,2" % command
-    images_and_versions = check_output(command)
+    command = build_docker_images_command(truncate=True, sudo=False)
+    images_and_versions = subprocess.check_output(command).strip().split('\n')
+    images_and_versions = [line.split()[0:2] for line in images_and_versions[1:]]
     name_filter = get_filter(namespace)
 
     def output_line_to_image(line):

lib/galaxy/tools/deps/mulled/mulled_build.py

@@ -87,17 +87,12 @@ def get_affected_packages(args):
     """
     recipes_dir = args.recipes_dir
     hours = args.diff_hours
-    cmd = """cd '%s' && git log --diff-filter=ACMRTUXB --name-only --pretty="" --since="%s hours ago" | grep -E '^recipes/.*/meta.yaml' | sort | uniq""" % (recipes_dir, hours)
-    pkg_list = check_output(cmd, shell=True)
-    ret = list()
-    for pkg in pkg_list.strip().split('\n'):
-        if pkg and os.path.exists(os.path.join( recipes_dir, pkg )):
-            ret.append( (get_pkg_name(args, pkg), get_tests(args, pkg)) )
-    return ret
-
-
-def check_output(cmd, shell=True):
-    return subprocess.check_output(cmd, shell=shell)
+    cmd = ['git', 'log', '--diff-filter=ACMRTUXB', '--name-only', '--pretty=""', '--since="%s hours ago"' % hours]
+    changed_files = subprocess.check_output(cmd, cwd=recipes_dir).strip().split('\n')
+    pkg_list = set([x for x in changed_files if x.startswith('recipes/') and x.endswith('meta.yaml')])
+    for pkg in pkg_list:
+        if pkg and os.path.exists(os.path.join(recipes_dir, pkg)):
+            yield (get_pkg_name(args, pkg), get_tests(args, pkg))
 
 
 def conda_versions(pkg_name, file_name):

lib/galaxy/tools/deps/mulled/mulled_build_channel.py

@@ -19,6 +19,7 @@ See recent changes that would be built with:
 from __future__ import print_function
 
 import os
+import subprocess
 import sys
 import time
 
@@ -27,7 +28,6 @@ from .mulled_build import (
     add_build_arguments,
     args_to_mull_targets_kwds,
     build_target,
-    check_output,
     conda_versions,
     get_affected_packages,
     mull_targets,
@@ -42,7 +42,13 @@ def _fetch_repo_data(args):
         repo_data = "%s-repodata.json" % channel
     if not os.path.exists(repo_data):
         platform_tag = 'osx-64' if sys.platform == 'darwin' else 'linux-64'
-        check_output("wget --quiet https://conda.anaconda.org/%s/%s/repodata.json.bz2 -O '%s.bz2' && bzip2 -d '%s.bz2'" % (channel, platform_tag, repo_data, repo_data))
+        subprocess.check_call([
+            'wget', '--quiet', 'https://conda.anaconda.org/%s/%s/repodata.json.bz2' % (channel, platform_tag),
+            '-O', '%s.bz2' % repo_data
+        ])
+        subprocess.check_call([
+            'bzip2', '-d', '%s.bz2' % repo_data
+        ])
     return repo_data
 
 
@@ -55,8 +61,7 @@ def _new_versions(quay, conda):
 
 def run_channel(args, build_last_n_versions=1):
     """Build list of involucro commands (as shell snippet) to run."""
-    pkgs = get_affected_packages(args)
-    for pkg_name, pkg_tests in pkgs:
+    for pkg_name, pkg_tests in get_affected_packages(args):
         repo_data = _fetch_repo_data(args)
         c = conda_versions(pkg_name, repo_data)
         # only package the most recent N versions

lib/galaxy/webhooks/__init__.py

@@ -67,7 +67,7 @@ class WebhooksRegistry(object):
     def load_webhook_from_config(self, config_dir, config_file):
         try:
             with open(os.path.join(config_dir, config_file)) as file:
-                config = yaml.load(file)
+                config = yaml.safe_load(file)
                 path = os.path.normpath(os.path.join(config_dir, '..'))
                 webhook = Webhook(
                     config['name'],