GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — [3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh · sethmlarson/cpython@fe60c9a

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

Misc
- NEWS.d/next/Tools-Demos
  - 2025-09-25-10-31-02.gh-issue-139330.5WWkY0.rst
- sbom.spdx.json
Tools/build
- generate_sbom.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎Misc/NEWS.d/next/Tools-Demos/2025-09-25-10-31-02.gh-issue-139330.5WWkY0.rst‎`

Copy file name to clipboard

+3Lines changed: 3 additions & 0 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+SBOM generation tool didn't cross-check the version and checksum values`
	`2`	+against the ``Modules/expat/refresh.sh`` script, leading to the values
	`3`	`+becoming out-of-date during routine updates.`

Collapse file

`‎Misc/sbom.spdx.json‎`

Copy file name to clipboardExpand all lines: Misc/sbom.spdx.json

+4-4Lines changed: 4 additions & 4 deletions

Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Collapse file

`‎Tools/build/generate_sbom.py‎`

Copy file name to clipboardExpand all lines: Tools/build/generate_sbom.py

+2-2Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -224,14 +224,14 @@ def check_sbom_packages(sbom_data: dict[str, typing.Any]) -> None:`
`224`	`224`	`)`
`225`	`225`
`226`	`226`	`# libexpat specifies its expected rev in a refresh script.`
`227`		`- if package["name"] == "libexpat":`
	`227`	`+ if package["name"] == "expat":`
`228`	`228`	`libexpat_refresh_sh = (CPYTHON_ROOT_DIR / "Modules/expat/refresh.sh").read_text()`
`229`	`229`	`libexpat_expected_version_match = re.search(`
`230`	`230`	`r"expected_libexpat_version=\"([0-9]+\.[0-9]+\.[0-9]+)\"",`
`231`	`231`	`libexpat_refresh_sh`
`232`	`232`	`)`
`233`	`233`	`libexpat_expected_sha256_match = re.search(`
`234`		`- r"expected_libexpat_sha256=\"[a-f0-9]{40}\"",`
	`234`	`+ r"expected_libexpat_sha256=\"([a-f0-9]{64})\"",`
`235`	`235`	`libexpat_refresh_sh`
`236`	`236`	`)`
`237`	`237`	`libexpat_expected_version = libexpat_expected_version_match and libexpat_expected_version_match.group(1)`

0 commit comments

Comments

0 (0)

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.