jethac opened a new issue, #42988: URL: https://github.com/apache/superset/issues/42988
### Problem `requirements/base.txt` contains 0 `--hash=` lines. The pins fix the version but not the artifact, so `pip install -r` accepts whatever the index serves for that version. A compromised or substituted wheel for an already-pinned version installs without complaint. This is the one remaining unhashed layer in an otherwise well-pinned supply chain — Actions are pinned to commit SHAs and Dependabot runs with a cooldown. ### Proposed change Generate the pins with hashes and install with `--require-hashes`: ``` uv pip compile --generate-hashes ... pip install --require-hashes -r requirements/base.txt ``` Two things worth knowing before starting. `--require-hashes` requires *every* dependency to be hashed, so it is all-or-nothing per file. And `scripts/uv-pip-compile.sh` plus `check-python-deps.yml` both need updating in the same change, or the drift check will fail on the new format. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
