mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
f65ce1d326
The proper CVE_PRODUCT is "wheel_project:wheel".
BEFORE: python:wheel -> 1 CVE
AFTER: wheel_project:wheel -> 2 CVEs
* Both are patched at 0.42.0.
- CVE-2022-40898 — DoS in wheel CLI via malicious input. Affects <0.38.1.
- CVE-2026-24049 — malicious wheel file can modify permissions of arbitrary
files. Affects 0.40.0–<0.46.2; covered by the existing
CVE-2026-24049.patch.
Note: The original commit targeted python3-wheel_0.47.0.bb. This is
adjusted for Scarthgap, where the recipe version is 0.42.0.
AI-Generated: Claude Sonnet 5
(From OE-Core rev: 6125825144dac3f5aea440307e4b6b7e76d5333a)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fe55278e01bbe434452191109278b436bf008ebc)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
20 lines
692 B
BlitzBasic
20 lines
692 B
BlitzBasic
SUMMARY = "The official binary distribution format for Python "
|
|
HOMEPAGE = "https://github.com/pypa/wheel"
|
|
SECTION = "devel/python"
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=7ffb0db04527cfe380e4f2726bd05ebf"
|
|
|
|
SRC_URI[sha256sum] = "c45be39f7882c9d34243236f2d63cbd58039e360f85d0913425fbd7ceea617a8"
|
|
|
|
inherit python_flit_core pypi
|
|
|
|
CVE_PRODUCT = "wheel_project:wheel"
|
|
|
|
SRC_URI += "file://CVE-2026-24049.patch"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|
|
|
|
# This used to use the bootstrap install which didn't compile. Until we bump the
|
|
# tmpdir version we can't compile the native otherwise the sysroot unpack fails
|
|
INSTALL_WHEEL_COMPILE_BYTECODE:class-native = "--no-compile-bytecode"
|