| Summary: | NPM fetcher is insecure | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] BitBake | Reporter: | Paul Barker <paul> |
| Component: | bitbake | Assignee: | Thomas Perrot <thomas.perrot> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Medium+ | CC: | ccasciato, contact, mathieu.dubois-briand, pavel, poky.bs.watcher, poky.watcher, pokylinux, randy.macleod, ross.burton, thomas.perrot |
| Version: | unspecified | ||
| Target Milestone: | 6.99 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
| Bug Depends on: | |||
| Bug Blocks: | 15551, 15607 | ||
|
Description
Paul Barker
2025-12-17 16:35:30 UTC
Richard to disable for M1. Then lower to medium, 60 priority and unassigned. We need help from npm users here. If we need something to test with, there are recipes on the master branch of meta-luneos (https://layers.openembedded.org/layerindex/branch/master/layer/meta-luneos/) which use npm:// and npmsw:// SRC_URIs. NPM fetcher has been disabled: https://git.openembedded.org/bitbake/commit/?id=355cd226e0720a9ed7683bb01c8c0a58eee03664 Reclassifiy the bug as a medium+ unassigned as a result. There are multiple package managers for JS that can use the same registries, I'm thinking that there's some sort of standard API, I'll look it up and see what other fetches do and I'll try to implement something. Not sure what npmsw does, but the npm fetcher doesn't even lock direct dependencies, meaning that you will end up with different dependencies once those dependencies have new releases. Hello, I propose to discard any checksum obtained from the registry and instead require the recipe author to supply the checksum directly in SRC_URI (sha512sum=, sha256sum=). The .resolved cache file would then store only the bare tarball URL. Kind regard, Thomas I submitted a patch series: https://lore.kernel.org/all/20260616-dev-tprrt-fix-npm-v1-0-6fde95bf0a8b@bootlin.com/ Patches got merged: https://git.openembedded.org/bitbake/commit/?id=f7608f3195af9abb405af9be95286e2267221331 https://git.openembedded.org/bitbake/commit/?id=9e45e00a2009f28829417c9517f5ab623f66dd5d https://git.openembedded.org/bitbake/commit/?id=355cd226e0720a9ed7683bb01c8c0a58eee03664 Paul, Thomas: can we close this bug entry? This has been resolved by the commits Mathieu linked to above. Further hardening of the npm fetcher is likely possible but that's a job for another bug. |