Re: [bitbake-devel] [PATCH 0/2] fetch/{npm,npmsw}: fix security issue and re-enable fetchers

--=-Xgw9st6c6FCxC7HFeIgY
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Richard,

On Tue, 2026-07-14 at 13:15 +0100, Richard Purdie via
lists.openembedded.org wrote:
> On Tue, 2026-06-16 at 15:37 +0200, Thomas Perrot via
> lists.openembedded.org wrote:
> > The npm and npmsw fetchers were disabled in 355cd226 (Jan 2026)
> > because
> > the npm fetcher retrieved checksums from the remote registry rather
> > than
> > from the recipe. This series fixes the root cause and re-enables
> > both
> > fetchers.
>=20
> Thanks for the patches, I'm not 100% convinced the issues are all
> resolved though.
>=20
> For example, even after the patches are applued, test_npm has a
> version
> in it but no checksum, yet the test passes, test_npm_premirrors also
> has no checksum and so on.
>=20
> How are we verifying the fetched sources in those cases?
>=20

Thanks for the review, you're right, and it's a real gap, not a
misreading of the tests. In v1, a missing checksum only produced a
bb.warn() and the download proceeded anyway, verified against nothing.
That's the same behaviour wget uses (opt-in via BB_STRICT_CHECKSUM),
but it doesn't make sense for npm here.
Unlike wget, npm has no independent anchor for the content it fetches,
so a missing checksum meant we were back to trusting the registry
unconditionally, which is the exact thing this series exists to stop
doing.

v2 will make the checksum mandatory and unconditional, will raise an
error regardless of BB_STRICT_CHECKSUM, when the SRC_URI haven't a
checksum parameter.

Will send v2 shortly.

Kind regards,
Thomas

> Cheers,
>=20
> Richard
>=20
>=20
> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-
> Links: You receive all messages sent to this group.
> View/Reply Online (#19837):
> https://lists.openembedded.org/g/bitbake-devel/message/19837
> Mute This Topic: https://lists.openembedded.org/mt/119833197/5443093
> Group Owner: [email protected]
> Unsubscribe:
> https://lists.openembedded.org/g/bitbake-devel/unsub=C2=A0[thomas.perrot@=
bootlin.com
> ]
> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-

--=20
Thomas Perrot, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com

--=-Xgw9st6c6FCxC7HFeIgY
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQGzBAABCAAdFiEEh0B3xqajCiMDqBIhn8ALBXH+Cu0FAmpfanYACgkQn8ALBXH+
Cu3yxgv8CD33wBwuR7W0vwtCL9O8UrPlu6V02BCV+xh0t0PlkqYblIhMt4e9lq8l
Vj0o0D3JJ4z07LH8lrdBu8E0R97Z2/J63q7kSyj0+45cmF9s/LQ7eLOJHvu3FH4E
JRRl0vY+NcPIiV3h80HkVw+DcGoC1FYKCTvf0zCIDOrI2BiMBNsY6d9JYjvjp50k
teHNoyKPQ6YKdXBTj2M/LK1KKfjzNnJeHsN8emSQdv0FzGn+iT82nPvA3wXQCzBh
PZrpFItIlXUxue2wNRuhqIjH7W8dZmh1ZPl5ZqyZK+LE1+6VKWlHsV4y76CndHBs
4RHA7CJm9AxroStIxWErDYQdDOwtfsaBEbXnP67a1Nkh3hCP29rLXg1+lJAR46bj
ahTx73Almn7ZtJfX3eX6yxsEZqVXwK0WeaywM+jiWc4D5d5FeegSpEe70rxiGxvu
GP8VoFrJ7xC840hvWqrLZ3GH+S1EtyrV+O7ww+lF/30KR8P5vtEdkgaqLikbYvcK
l85RagS6
=ol2Z
-----END PGP SIGNATURE-----

--=-Xgw9st6c6FCxC7HFeIgY--