Repository navigation
Commit ade85bc
authored
[3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh
* [3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh
Check expat version/checksum in SBOM with refresh.sh
(cherry picked from commit 89b5571)
Co-authored-by: Seth Michael Larson <seth@python.org>
* 2.7.11 parent cc9a7d8 commit ade85bc
3 files changed
Lines changed: 9 additions & 6 deletions
File tree
- Misc
- NEWS.d/next/Tools-Demos
- Tools/build
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,3 @@ | |||
| 1 | + SBOM generation tool didn't cross-check the version and checksum values | ||
| 2 | + against the ``Modules/expat/refresh.sh`` script, leading to the values | ||
| 3 | + becoming out-of-date during routine updates. | ||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -224,14 +224,14 @@ def check_sbom_packages(sbom_data: dict[str, typing.Any]) -> None: | |||
| 224 | 224 | ) | |
| 225 | 225 | ||
| 226 | 226 | # libexpat specifies its expected rev in a refresh script. | |
| 227 | - if package["name"] == "libexpat": | ||
| 227 | + if package["name"] == "expat": | ||
| 228 | 228 | libexpat_refresh_sh = (CPYTHON_ROOT_DIR / "Modules/expat/refresh.sh").read_text() | |
| 229 | 229 | libexpat_expected_version_match = re.search( | |
| 230 | 230 | r"expected_libexpat_version=\"([0-9]+\.[0-9]+\.[0-9]+)\"", | |
| 231 | 231 | libexpat_refresh_sh | |
| 232 | 232 | ) | |
| 233 | 233 | libexpat_expected_sha256_match = re.search( | |
| 234 | - r"expected_libexpat_sha256=\"[a-f0-9]{40}\"", | ||
| 234 | + r"expected_libexpat_sha256=\"([a-f0-9]{64})\"", | ||
| 235 | 235 | libexpat_refresh_sh | |
| 236 | 236 | ) | |
| 237 | 237 | libexpat_expected_version = libexpat_expected_version_match and libexpat_expected_version_match.group(1) | |
0 commit comments