GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh · Issue #139330 · python/cpython

SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh #139330

New issue
Copy link
New issue
Copy link
Closed
Closed
SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh#139330
Copy link
Assignees
sethmlarson
Labels
3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixestopic-XMLtriagedThe issue has been accepted as valid by a triager.The issue has been accepted as valid by a triager.type-securityA security issueA security issue

Description

@sethmlarson
sethmlarson
opened on Sep 25, 2025
Issue body actions

Bug report

Bug description:

There's a bad comparison against the magic string == "libexpat" where it should check against == "expat" for the package name. This means that SBOM data for expat doesn't get cross-checked automatically against the refresh.sh script.

Found while reviewing #139319

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

  • gh-139330: Check expat version/checksum in SBOM with refresh.sh #139331
  • [3.14] gh-139330: Check expat version/checksum in SBOM with refresh.sh #139336
  • [3.13] gh-139330: Check expat version/checksum in SBOM with refresh.sh #139337
  • [3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh #139338
  • [3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh #139339

Activity

  1. sethmlarson
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Sep 25, 2025
  2. sethmlarson
    self-assigned this
    on Sep 25, 2025
  3. StanFromIreland
    added
    type-securityA security issueA security issue
    triagedThe issue has been accepted as valid by a triager.The issue has been accepted as valid by a triager.
    topic-XML
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Sep 25, 2025
  4. sethmlarson
    added a commit that references this issue on Sep 25, 2025

    gh-139330: Check expat version/checksum in SBOM with refresh.sh

    89b5571
  5. miss-islington
    added 3 commits that reference this issue on Sep 25, 2025

    pythongh-139330: Check expat version/checksum in SBOM with refresh.sh

    4d5aa40

    pythongh-139330: Check expat version/checksum in SBOM with refresh.sh

    62d988e

    pythongh-139330: Check expat version/checksum in SBOM with refresh.sh

    a303f92
  6. sethmlarson
    added 4 commits that reference this issue on Sep 25, 2025

    [3.13] gh-139330: Check expat version/checksum in SBOM with refresh.sh

    11d6c46

    [3.12] pythongh-139330: Check expat version/checksum in SBOM with ref…

    fe60c9a

    [3.14] gh-139330: Check expat version/checksum in SBOM with refresh.sh

    7519ac2

    [3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh

    ade85bc
  7. sethmlarson commented on Sep 26, 2025

    @sethmlarson
    sethmlarson
    on Sep 26, 2025
    ContributorAuthor
    More actions

    All backports merged, closing!

    Reacted by Stan Ulbrych
  8. sethmlarson
    closed this as completedon Sep 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @sethmlarson
    sethmlarson

Labels

3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixestopic-XMLtriagedThe issue has been accepted as valid by a triager.The issue has been accepted as valid by a triager.type-securityA security issueA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.