Re: [bitbake-devel] [PATCH 0/2] fetch/{npm,npmsw}: fix security issue and re-enable fetchers

On Tue, 2026-06-16 at 15:37 +0200, Thomas Perrot via lists.openembedded.org=
 wrote:
> The npm and npmsw fetchers were disabled in 355cd226 (Jan 2026) because
> the npm fetcher retrieved checksums from the remote registry rather than
> from the recipe. This series fixes the root cause and re-enables both
> fetchers.

Thanks for the patches, I'm not 100% convinced the issues are all resolved =
though.

For example, even after the patches are applued, test_npm has a version
in it but no checksum, yet the test passes, test_npm_premirrors also
has no checksum and so on.

How are we verifying the fetched sources in those cases?

Cheers,

Richard