The NPM fetcher is being disabled as it is insecure. To re-enable this, we need the security issues to be resolved *AND* tests to be added. The NPM fetcher gets the checksum for each source from the remote registry. This contradicts our usual policy of storing checksums in the recipe so that we can ensure that the remote file has not been altered. If the remote is in charge of both the checksum and the source contents, we can't detect tampering from a compromised NPM registry.
Richard to disable for M1. Then lower to medium, 60 priority and unassigned. We need help from npm users here.
If we need something to test with, there are recipes on the master branch of meta-luneos (https://layers.openembedded.org/layerindex/branch/master/layer/meta-luneos/) which use npm:// and npmsw:// SRC_URIs.
NPM fetcher has been disabled: https://git.openembedded.org/bitbake/commit/?id=355cd226e0720a9ed7683bb01c8c0a58eee03664 Reclassifiy the bug as a medium+ unassigned as a result.
There are multiple package managers for JS that can use the same registries, I'm thinking that there's some sort of standard API, I'll look it up and see what other fetches do and I'll try to implement something. Not sure what npmsw does, but the npm fetcher doesn't even lock direct dependencies, meaning that you will end up with different dependencies once those dependencies have new releases.
Hello, I propose to discard any checksum obtained from the registry and instead require the recipe author to supply the checksum directly in SRC_URI (sha512sum=, sha256sum=). The .resolved cache file would then store only the bare tarball URL. Kind regard, Thomas
I submitted a patch series: https://lore.kernel.org/all/20260616-dev-tprrt-fix-npm-v1-0-6fde95bf0a8b@bootlin.com/
Patches got merged: https://git.openembedded.org/bitbake/commit/?id=f7608f3195af9abb405af9be95286e2267221331 https://git.openembedded.org/bitbake/commit/?id=9e45e00a2009f28829417c9517f5ab623f66dd5d https://git.openembedded.org/bitbake/commit/?id=355cd226e0720a9ed7683bb01c8c0a58eee03664 Paul, Thomas: can we close this bug entry?
This has been resolved by the commits Mathieu linked to above. Further hardening of the npm fetcher is likely possible but that's a job for another bug.