mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

recipetool: pypi: do not clobber SRC_URI checksums

Browse Source 
The pypi change:
"85a2a6f68af recipetool: create_buildsys_python: add pypi support"
deleted all the SRC_URI variables, including the SRC_URI checksums.
These are not generated by the pypi.bbclass (how could they be trusted?)

Without the checksum(s), we are vulnerable to a man-in-the-middle attack
and zero checks on the validity of the downloaded tarball from pypi.org.

Fix by only setting S and SRC_URI to None.

(From OE-Core rev: 560181a52111569f7bc57b09139b42510e0d0325)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Tim Orling
2023-12-08 17:40:04 -08:00
committed by Richard Purdie
parent 95c187e54e
commit 78ef0313ee
1 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
scripts/lib/recipetool/create_buildsys_python.py
View File

@@ -167,16 +167,11 @@ class PythonRecipeHandler(RecipeHandler):
if pypi_package_ext != "tar.gz":
extravalues["PYPI_PACKAGE_EXT"] = pypi_package_ext
# Pypi class will handle S and SRC_URIxxx variables, so remove them
# Pypi class will handle S and SRC_URI variables, so remove them
# TODO: allow oe.recipeutils.patch_recipe_lines() to accept regexp so we can simplify the following to:
# extravalues['SRC_URI(?:\[.*?\])?'] = None
extravalues['S'] = None
extravalues['SRC_URI'] = None
extravalues['SRC_URI[md5sum]'] = None
extravalues['SRC_URI[sha1sum]'] = None
extravalues['SRC_URI[sha256sum]'] = None
extravalues['SRC_URI[sha384sum]'] = None
extravalues['SRC_URI[sha512sum]'] = None
classes.append('pypi')