| Message ID | 20260825-enable-npmsw-fetcher-wrynose-v1-0-425c8cc1e111@bootlin.com |
|---|---|
| Headers | show |
| Series | fetch/{npm,npmsw}: fix security issue and re-enable fetchers | expand |
Hello, On Tue Aug 25, 2026 at 3:02 PM CEST, Antonin Godard via lists.openembedded.org wrote: > This is a proposal to backport patches re-enabling the npm and npmsw > fetcher on 2.18 (Wrynose). The two patches from this series are simple > cherry-picks, and had no conflicts applying. > > Applying these two patches locally is also fine to me, but as this seems > to be working as-is I figured this might be helpful to others - up to the > maintainer(s) to decide. I understand this is tempting but that'd be a feature addition from wrynose point of view and so, unacceptable per stable policy. Without exception to the rules, we'll have to live with wrynose not having a NPM fetcher. Regards,
Hi Yoann, On Tue Aug 25, 2026 at 3:10 PM CEST, Yoann Congal via lists.openembedded.org wrote: > Hello, > > On Tue Aug 25, 2026 at 3:02 PM CEST, Antonin Godard via lists.openembedded.org wrote: >> This is a proposal to backport patches re-enabling the npm and npmsw >> fetcher on 2.18 (Wrynose). The two patches from this series are simple >> cherry-picks, and had no conflicts applying. >> >> Applying these two patches locally is also fine to me, but as this seems >> to be working as-is I figured this might be helpful to others - up to the >> maintainer(s) to decide. > > I understand this is tempting but that'd be a feature addition from > wrynose point of view and so, unacceptable per stable policy. > > Without exception to the rules, we'll have to live with wrynose not > having a NPM fetcher. Understood, and fine by me. You'll have a link to share to others wondering about it now. :) Thanks for the swift answer! Antonin
This is a proposal to backport patches re-enabling the npm and npmsw fetcher on 2.18 (Wrynose). The two patches from this series are simple cherry-picks, and had no conflicts applying. Applying these two patches locally is also fine to me, but as this seems to be working as-is I figured this might be helpful to others - up to the maintainer(s) to decide. Tests are passing locally: $ bitbake-selftest -v bb.tests.fetch.NPMTest test_npm (bb.tests.fetch.NPMTest.test_npm) ... ok test_npm_bad_checksum (bb.tests.fetch.NPMTest.test_npm_bad_checksum) ... ok test_npm_bad_recipe_checksum_rejected (bb.tests.fetch.NPMTest.test_npm_bad_recipe_checksum_rejected) A wrong sha512sum param in SRC_URI causes the fetch to fail. ... ok test_npm_destsuffix_downloadfilename (bb.tests.fetch.NPMTest.test_npm_destsuffix_downloadfilename) ... ok test_npm_mirrors (bb.tests.fetch.NPMTest.test_npm_mirrors) ... ok test_npm_no_checksum_rejected (bb.tests.fetch.NPMTest.test_npm_no_checksum_rejected) A missing checksum in SRC_URI is rejected regardless of BB_STRICT_CHECKSUM. ... ok test_npm_no_network_no_tarball (bb.tests.fetch.NPMTest.test_npm_no_network_no_tarball) ... ok test_npm_no_network_with_tarball (bb.tests.fetch.NPMTest.test_npm_no_network_with_tarball) ... ok test_npm_package_invalid (bb.tests.fetch.NPMTest.test_npm_package_invalid) ... ok test_npm_package_none (bb.tests.fetch.NPMTest.test_npm_package_none) ... ok test_npm_premirrors (bb.tests.fetch.NPMTest.test_npm_premirrors) ... ok test_npm_premirrors_with_specified_filename (bb.tests.fetch.NPMTest.test_npm_premirrors_with_specified_filename) ... ok test_npm_recipe_checksum (bb.tests.fetch.NPMTest.test_npm_recipe_checksum) A sha512sum param in SRC_URI is forwarded to the proxy and verified. ... ok test_npm_registry_alternate (bb.tests.fetch.NPMTest.test_npm_registry_alternate) ... ok test_npm_registry_invalid (bb.tests.fetch.NPMTest.test_npm_registry_invalid) ... ok test_npm_registry_none (bb.tests.fetch.NPMTest.test_npm_registry_none) ... ok test_npm_version_invalid (bb.tests.fetch.NPMTest.test_npm_version_invalid) ... ok test_npm_version_latest_rejected (bb.tests.fetch.NPMTest.test_npm_version_latest_rejected) ... ok test_npm_version_none (bb.tests.fetch.NPMTest.test_npm_version_none) ... ok test_npmsw (bb.tests.fetch.NPMTest.test_npmsw) ... ok test_npmsw_bad_checksum (bb.tests.fetch.NPMTest.test_npmsw_bad_checksum) ... ok test_npmsw_bundled (bb.tests.fetch.NPMTest.test_npmsw_bundled) ... ok test_npmsw_destsuffix (bb.tests.fetch.NPMTest.test_npmsw_destsuffix) ... ok test_npmsw_dev (bb.tests.fetch.NPMTest.test_npmsw_dev) ... ok test_npmsw_git (bb.tests.fetch.NPMTest.test_npmsw_git) ... ok test_npmsw_mirrors (bb.tests.fetch.NPMTest.test_npmsw_mirrors) ... ok test_npmsw_no_network_no_tarball (bb.tests.fetch.NPMTest.test_npmsw_no_network_no_tarball) ... ok test_npmsw_no_network_with_tarball (bb.tests.fetch.NPMTest.test_npmsw_no_network_with_tarball) ... ok test_npmsw_npm_reusability (bb.tests.fetch.NPMTest.test_npmsw_npm_reusability) ... ok test_npmsw_premirrors (bb.tests.fetch.NPMTest.test_npmsw_premirrors) ... ok ---------------------------------------------------------------------- Ran 30 tests in 101.185s OK Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> --- Thomas Perrot (2): fetch/{npm,npmsw}: re-enable fetchers now that checksums come from SRC_URI tests/fetch: restore and extend npm/npmsw test coverage lib/bb/fetch2/npm.py | 111 +++++++++++++++++++++++++----------------- lib/bb/fetch2/npmsw.py | 12 ++--- lib/bb/tests/fetch.py | 129 +++++++++++++++++++++++++++++++++++++------------ 3 files changed, 169 insertions(+), 83 deletions(-) --- base-commit: 0ad6c1c34a5e07a5f8dd66ab248c1e7b37b69fa9 change-id: 20260825-enable-npmsw-fetcher-wrynose-2574d377ec2b