From patchwork Sat Dec 9 01:40:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 35990 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56E1FC4167B for ; Sat, 9 Dec 2023 01:41:01 +0000 (UTC) Received: from mail-il1-f169.google.com (mail-il1-f169.google.com [209.85.166.169]) by mx.groups.io with SMTP id smtpd.web10.1581.1702086054677070227 for ; Fri, 08 Dec 2023 17:40:54 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=iseCP1yP; spf=pass (domain: gmail.com, ip: 209.85.166.169, mailfrom: ticotimo@gmail.com) Received: by mail-il1-f169.google.com with SMTP id e9e14a558f8ab-35d67870032so13035765ab.2 for ; Fri, 08 Dec 2023 17:40:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702086053; x=1702690853; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=IbshQl0PZSINi8jQx2imUS46DssuYF8qwnCaOcRIN2c=; b=iseCP1yPocrpBp1YREwlSWVApBPIdbR1SVO1aKWMHfyrdGExSvHZvWKOSVcWV9S2ER LGLhSD4JDm00mfff5ZZvgZuXCdD7gvxbvASDsU6Skmkk7CN+XOuDxyUNGkPKalFxMlBq A9G1urvuMotxmm+SRe6p2OX46yHBe9kaW++SMDyGVPfeaKDaZa/U4rT/s/kMPuqV7yO4 IuoDKTyqHUvsPeHY1Jp2VhoAQ5N/foRzxv7Gme5hYj8ocWLr5yNHJYCS3vFErt9ML1QZ E43M9Pm7eggC692L3lr4syljTXoWcLSHfyar9q+9aOgEobS5ANYsHUG6KbQ/iL00tUAx HtOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702086053; x=1702690853; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=IbshQl0PZSINi8jQx2imUS46DssuYF8qwnCaOcRIN2c=; b=R3L3CSEOptEc3aMEjNGqX8wbfoxk5fbIMbmfwHY7kTb2Gmb0EqfAc+AU5oN7nD4cyK hdzvcbCXFSjmtS/Vl3Ske2Hh3eb081U/MMEe6fHPorJqtoRdzjYp+M/VmuYpv1cHttDc dQROgKT8KADzYT4dfhdGDo2AwjYWA6+lKmMqQWWV2nhWk5USrycVHtog3+FHoHE78MLY 0Aodrz7qyP4kix4zPq2uHtCk+eOUZtqDTFUjdcZY/3F6EizR76StTlcb0VfgysK2kvkP x71jR4eT9m+3VXGOcpM8NNfwS12mXKf81UxNEaTpfwfECkb0wKkP4EhrUYvFZCd26juD 7GLA== X-Gm-Message-State: AOJu0YzQk9vhUoeCXQMQj2Kt7ePKrIXwr83xcUz6M60UwO31nphjNFk7 uhZS1MiKEtyjgv8H5G2gLNR7L1mpDP0= X-Google-Smtp-Source: AGHT+IHCSwgIJguqPCSKskLZ+t64V9eV9t8Jh1qHAVe1EkS7pdPgICG2wzrjyk/ZYsSehNw1JjJMQA== X-Received: by 2002:a05:6e02:17c8:b0:35d:659d:1c70 with SMTP id z8-20020a056e0217c800b0035d659d1c70mr1326928ilu.89.1702086053463; Fri, 08 Dec 2023 17:40:53 -0800 (PST) Received: from chiron.hsd1.or.comcast.net ([2601:1c0:ca00:cea0:7aea:237e:f2fd:77b]) by smtp.gmail.com with ESMTPSA id jj17-20020a170903049100b001d2f0985020sm1704718plb.294.2023.12.08.17.40.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Dec 2023 17:40:52 -0800 (PST) From: Tim Orling X-Google-Original-From: Tim Orling To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH v2] recipetool: pypi: do not clobber SRC_URI checksums Date: Fri, 8 Dec 2023 17:40:04 -0800 Message-Id: <20231209014003.1213392-1-tim.orling@konsulko.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 09 Dec 2023 01:41:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/192094 The pypi change: "85a2a6f68af recipetool: create_buildsys_python: add pypi support" deleted all the SRC_URI variables, including the SRC_URI checksums. These are not generated by the pypi.bbclass (how could they be trusted?) Without the checksum(s), we are vulnerable to a man-in-the-middle attack and zero checks on the validity of the downloaded tarball from pypi.org. Fix by only setting S and SRC_URI to None. Signed-off-by: Tim Orling --- Changes in v2: - clarify the pypi.bbclass comment scripts/lib/recipetool/create_buildsys_python.py | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/scripts/lib/recipetool/create_buildsys_python.py b/scripts/lib/recipetool/create_buildsys_python.py index 5e07222ece1..a2af41fdda8 100644 --- a/scripts/lib/recipetool/create_buildsys_python.py +++ b/scripts/lib/recipetool/create_buildsys_python.py @@ -167,16 +167,11 @@ class PythonRecipeHandler(RecipeHandler): if pypi_package_ext != "tar.gz": extravalues["PYPI_PACKAGE_EXT"] = pypi_package_ext - # Pypi class will handle S and SRC_URIxxx variables, so remove them + # Pypi class will handle S and SRC_URI variables, so remove them # TODO: allow oe.recipeutils.patch_recipe_lines() to accept regexp so we can simplify the following to: # extravalues['SRC_URI(?:\[.*?\])?'] = None extravalues['S'] = None extravalues['SRC_URI'] = None - extravalues['SRC_URI[md5sum]'] = None - extravalues['SRC_URI[sha1sum]'] = None - extravalues['SRC_URI[sha256sum]'] = None - extravalues['SRC_URI[sha384sum]'] = None - extravalues['SRC_URI[sha512sum]'] = None classes.append('pypi')