> -Original Message-
> From: openembedded-core@lists.openembedded.org
> On Behalf Of Tim Orling
> Sent: den 9 december 2023 02:37
> To: openembedded-core@lists.openembedded.org
> Cc: Tim Orling
> Subject: [OE-core] [PATCH] recipetool: pypi: do not clobber SRC_URI checksums
>
> The pypi change:
> "85a2a6f68af recipetool: create_buildsys_python: add pypi support"
> deleted all the SRC_URI variables, including the SRC_URI checksums.
> These are not generated by the pypi.bbclass (how could they be trusted?)
>
> Without the checksum(s), we are vulnerable to a man-in-the-middle attack
> and zero checks on the validity of the downloaded tarball from pypi.org.
>
> Fix by only setting S and SRC_URI to None.
>
> Signed-off-by: Tim Orling
> ---
> scripts/lib/recipetool/create_buildsys_python.py | 5 -
> 1 file changed, 5 deletions(-)
>
> diff --git a/scripts/lib/recipetool/create_buildsys_python.py
> b/scripts/lib/recipetool/create_buildsys_python.py
> index 5e07222ece1..66de36ba3e4 100644
> --- a/scripts/lib/recipetool/create_buildsys_python.py
> +++ b/scripts/lib/recipetool/create_buildsys_python.py
> @@ -172,11 +172,6 @@ class PythonRecipeHandler(RecipeHandler):
> # extravalues['SRC_URI(?:\[.*?\])?'] = None
The TODO comment above should also be removed as it should not be done.
> extravalues['S'] = None
> extravalues['SRC_URI'] = None
> -extravalues['SRC_URI[md5sum]'] = None
> -extravalues['SRC_URI[sha1sum]'] = None
> -extravalues['SRC_URI[sha256sum]'] = None
> -extravalues['SRC_URI[sha384sum]'] = None
> -extravalues['SRC_URI[sha512sum]'] = None
>
> classes.append('pypi')
>
> --
> 2.34.1
//Peter
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#192095):
https://lists.openembedded.org/g/openembedded-core/message/192095
Mute This Topic: https://lists.openembedded.org/mt/103067452/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
