From patchwork Sat Dec 9 01:37:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 35989 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DD52C4167B for ; Sat, 9 Dec 2023 01:37:31 +0000 (UTC) Received: from mail-oi1-f170.google.com (mail-oi1-f170.google.com [209.85.167.170]) by mx.groups.io with SMTP id smtpd.web11.1457.1702085847903978339 for ; Fri, 08 Dec 2023 17:37:28 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=h0JkGAJB; spf=pass (domain: gmail.com, ip: 209.85.167.170, mailfrom: ticotimo@gmail.com) Received: by mail-oi1-f170.google.com with SMTP id 5614622812f47-3b9dbbaa9a9so1874825b6e.2 for ; Fri, 08 Dec 2023 17:37:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702085847; x=1702690647; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+6fYOmTyixqwpGNr5mtOT0SpU9Hwr8qfB0mEEN5jQeQ=; b=h0JkGAJBzHleFekBwQCBtbtVidmHfj8/qtQ2onJqEftaA47/HQyjVKX1XZ5C/H6Pij gv6qyNZFb3nNMhlOoW6yLpTXVwNjk/kob5LAd030mckVaQSZzNZKGcZ8oBqbguH32Wwg ZUZI7GQf7A+XzBblR9CyIZf/0KTdve6AsuxTfSqa8YXvMc2eKLxgJticIggxyPjAX7MU Cf80rvffwXW0jQloB+ANWn/X9ES+41w0GAhxOQBX7NvWDriUJxKJlVLs/LSFM3fjeOY5 OxXD2X61972FmKAfntbW1bYH8ZBB9T8XL4tmcY4hQwMk4r1U9MCJHwkcpCzgxU8fibEo 18mA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702085847; x=1702690647; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=+6fYOmTyixqwpGNr5mtOT0SpU9Hwr8qfB0mEEN5jQeQ=; b=DAzgQ9p/2IwHU6GE/ZeJ+6CCeKhgzoqKep65ubXJKQ1aCpNrNieXGx2ps/PHhL0O5P mlbzLrZBy96M35eYXlYV9XMmdDWBMM5Smmep/nUXsv9W3kmaTmo3sFGzSuhGRSrJ1uMi egyPaTtloiSDB1mPhZzrppwPnfB0P1eN0s5u2/BGufMGfuKVwT3rH67eTbuHs1eobrV6 OY+KndNc6E/FcFRFZXH654hymUAuZE9B3Xn1W+d7T50QY+uZZdbXZ0YasGMlNmifqUAO W5W+uXOsatK0lqOiMy/HfJyPWHTBYQJ+AMUI0QKiPMZ2vK5XJFtlTqiy1qBaBqNR2v2n yuwg== X-Gm-Message-State: AOJu0YwAmw5y2g1pAj+SygKAkMYyGuR5luR1HPTCECryyWGj/3jQXxK1 WoYl2OQ9lBzxBsL0TCbhcXBGUyIxgw8= X-Google-Smtp-Source: AGHT+IFqTsrD2nU3z4ij5UjcEp+ZW4yN+9+33fyphBWRUG85aEXrSXo21eYqA1VbM1F/pZmI8Gdhwg== X-Received: by 2002:a05:6808:2181:b0:3b8:3f9f:4c73 with SMTP id be1-20020a056808218100b003b83f9f4c73mr1286499oib.26.1702085846868; Fri, 08 Dec 2023 17:37:26 -0800 (PST) Received: from chiron.hsd1.or.comcast.net ([2601:1c0:ca00:cea0:7aea:237e:f2fd:77b]) by smtp.gmail.com with ESMTPSA id 4-20020a170902c24400b001cffd42711csm2335429plg.199.2023.12.08.17.37.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Dec 2023 17:37:26 -0800 (PST) From: Tim Orling X-Google-Original-From: Tim Orling To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH] recipetool: pypi: do not clobber SRC_URI checksums Date: Fri, 8 Dec 2023 17:37:15 -0800 Message-Id: <20231209013715.1212333-1-tim.orling@konsulko.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 09 Dec 2023 01:37:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192093 The pypi change: "85a2a6f68af recipetool: create_buildsys_python: add pypi support" deleted all the SRC_URI variables, including the SRC_URI checksums. These are not generated by the pypi.bbclass (how could they be trusted?) Without the checksum(s), we are vulnerable to a man-in-the-middle attack and zero checks on the validity of the downloaded tarball from pypi.org. Fix by only setting S and SRC_URI to None. Signed-off-by: Tim Orling --- scripts/lib/recipetool/create_buildsys_python.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/scripts/lib/recipetool/create_buildsys_python.py b/scripts/lib/recipetool/create_buildsys_python.py index 5e07222ece1..66de36ba3e4 100644 --- a/scripts/lib/recipetool/create_buildsys_python.py +++ b/scripts/lib/recipetool/create_buildsys_python.py @@ -172,11 +172,6 @@ class PythonRecipeHandler(RecipeHandler): # extravalues['SRC_URI(?:\[.*?\])?'] = None extravalues['S'] = None extravalues['SRC_URI'] = None - extravalues['SRC_URI[md5sum]'] = None - extravalues['SRC_URI[sha1sum]'] = None - extravalues['SRC_URI[sha256sum]'] = None - extravalues['SRC_URI[sha384sum]'] = None - extravalues['SRC_URI[sha512sum]'] = None classes.append('pypi')