diff options
| author |   Tim Orling <ticotimo@gmail.com> | 2023-12-08 17:40:04 -0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-12-09 10:24:15 +0000 |
| commit | 560181a52111569f7bc57b09139b42510e0d0325 (patch) | |
| tree | 507f904f3c713ac915c26f6de5db021a49e936f0 /scripts | |
| parent | 29775b5ecfc8d811293962f050fcfc3b3ad7efde (diff) | |
| download | openembedded-core-contrib-560181a52111569f7bc57b09139b42510e0d0325.tar.gz | |
recipetool: pypi: do not clobber SRC_URI checksums
The pypi change:
"85a2a6f68af recipetool: create_buildsys_python: add pypi support"
deleted all the SRC_URI variables, including the SRC_URI checksums.
These are not generated by the pypi.bbclass (how could they be trusted?)
Without the checksum(s), we are vulnerable to a man-in-the-middle attack
and zero checks on the validity of the downloaded tarball from pypi.org.
Fix by only setting S and SRC_URI to None.
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/lib/recipetool/create_buildsys_python.py | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/scripts/lib/recipetool/create_buildsys_python.py b/scripts/lib/recipetool/create_buildsys_python.py index 5e07222ece..a2af41fdda 100644 --- a/scripts/lib/recipetool/create_buildsys_python.py +++ b/scripts/lib/recipetool/create_buildsys_python.py @@ -167,16 +167,11 @@ class PythonRecipeHandler(RecipeHandler): if pypi_package_ext != "tar.gz": extravalues["PYPI_PACKAGE_EXT"] = pypi_package_ext - # Pypi class will handle S and SRC_URIxxx variables, so remove them + # Pypi class will handle S and SRC_URI variables, so remove them # TODO: allow oe.recipeutils.patch_recipe_lines() to accept regexp so we can simplify the following to: # extravalues['SRC_URI(?:\[.*?\])?'] = None extravalues['S'] = None extravalues['SRC_URI'] = None - extravalues['SRC_URI[md5sum]'] = None - extravalues['SRC_URI[sha1sum]'] = None - extravalues['SRC_URI[sha256sum]'] = None - extravalues['SRC_URI[sha384sum]'] = None - extravalues['SRC_URI[sha512sum]'] = None classes.append('pypi') |