Update protobuf

ethpm/_utils/ipfs.py

@@ -19,7 +19,7 @@
     Descriptor,
 )
 
-from ethpm._utils.protobuf.ipfs_file_pb2 import (
+from ethpm._utils.protobuf.ipfs_file_pb2 import (  # type: ignore
     Data,
     PBNode,
 )
@@ -91,8 +91,7 @@ def serialize_bytes(file_bytes: bytes) -> Descriptor:
     file_size = len(file_bytes)
 
     data_protobuf = Data(
-        # type ignored b/c DataType is manually attached in ipfs_file_pb2.py
-        Type=Data.DataType.Value("File"),  # type: ignore
+        Type=Data.DataType.Value("File"),
         Data=file_bytes,
         filesize=file_size,
     )

ethpm/assets/ipfs_file.proto

@@ -0,0 +1,32 @@
+/* This file will generate ipfs_file_pb2.py when invoked on the command line via: */
+/*     $ protoc -I=$SRC_DIR --python_out=$DST_DIR $SRC_DIR/ipfs_file.proto */
+/* in this case: */
+/*     $ protoc -I=ethpm/assets --python_out=ethpm/_utils/protobuf ethpm/assets/ipfs_file.proto */
+
+syntax = "proto3";
+
+message Data {
+    enum DataType {
+        Raw = 0;
+        Directory = 1;
+        File = 2;
+        Metadata = 3;
+        Symlink = 4;
+    }
+
+    DataType Type = 1;
+    optional bytes Data = 2;
+    optional uint64 filesize = 3;
+    repeated uint64 blocksizes = 4;
+}
+
+message PBLink {
+    optional bytes Hash = 1;
+    optional string Name = 2;
+    optional uint64 Tsize = 3;
+}
+
+message PBNode {
+    repeated PBLink Links = 2;
+    optional bytes Data = 1;
+}

newsfragments/2666.bugfix.rst

@@ -0,0 +1 @@
+Protobuf dependency had a DoS-able bug. It was fixed in v4.21.6. See: https://nvd.nist.gov/vuln/detail/CVE-2022-1941