GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Check expat version/checksum in SBOM with refresh.sh · python/cpython@d95df91

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

Misc
- NEWS.d/next/Tools-Demos
  - 2025-09-25-10-31-02.gh-issue-139330.5WWkY0.rst
- sbom.spdx.json
Tools/build
- generate_sbom.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎Misc/NEWS.d/next/Tools-Demos/2025-09-25-10-31-02.gh-issue-139330.5WWkY0.rst‎`

Copy file name to clipboard

+3Lines changed: 3 additions & 0 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+SBOM generation tool didn't cross-check the version and checksum values`
	`2`	+against the ``Modules/expat/refresh.sh`` script, leading to the values
	`3`	`+becoming out-of-date during routine updates.`

Collapse file

`‎Misc/sbom.spdx.json‎`

Copy file name to clipboardExpand all lines: Misc/sbom.spdx.json

+4-4Lines changed: 4 additions & 4 deletions

Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Collapse file

`‎Tools/build/generate_sbom.py‎`

Copy file name to clipboardExpand all lines: Tools/build/generate_sbom.py

+2-2Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -242,14 +242,14 @@ def check_sbom_packages(sbom_data: dict[str, typing.Any]) -> None:`
`242`	`242`	`)`
`243`	`243`
`244`	`244`	`# libexpat specifies its expected rev in a refresh script.`
`245`		`- if package["name"] == "libexpat":`
	`245`	`+ if package["name"] == "expat":`
`246`	`246`	`libexpat_refresh_sh = (CPYTHON_ROOT_DIR / "Modules/expat/refresh.sh").read_text()`
`247`	`247`	`libexpat_expected_version_match = re.search(`
`248`	`248`	`r"expected_libexpat_version=\"([0-9]+\.[0-9]+\.[0-9]+)\"",`
`249`	`249`	`libexpat_refresh_sh`
`250`	`250`	`)`
`251`	`251`	`libexpat_expected_sha256_match = re.search(`
`252`		`- r"expected_libexpat_sha256=\"[a-f0-9]{40}\"",`
	`252`	`+ r"expected_libexpat_sha256=\"([a-f0-9]{64})\"",`
`253`	`253`	`libexpat_refresh_sh`
`254`	`254`	`)`
`255`	`255`	`libexpat_expected_version = libexpat_expected_version_match and libexpat_expected_version_match.group(1)`

0 commit comments

Comments

0 (0)

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.