@@ -21,6 +21,7 @@ import json
import os
import re
import bb
+from bb.fetch2 import FetchError
from bb.fetch2 import Fetch
from bb.fetch2 import FetchMethod
from bb.fetch2 import ParameterError
@@ -44,7 +45,7 @@ def foreach_dependencies(shrinkwrap, callback=None, dev=False):
location = the location of the package (string)
"""
packages = shrinkwrap.get("packages")
- if not packages:
+ if packages is None:
raise FetchError("Invalid shrinkwrap file format")
for location, data in packages.items():
@@ -63,11 +64,7 @@ class NpmShrinkWrap(FetchMethod):
def supports(self, ud, d):
"""Check if a given url can be fetched with npmsw"""
- #return ud.type in ["npmsw"]
- if ud.type in ["npmsw"]:
- from bb.parse import SkipRecipe
- raise SkipRecipe("The npmsw fetcher has been disabled due to security issues and there is no maintainer to address them")
- return False
+ return ud.type in ["npmsw"]
def urldata_init(self, ud, d):
"""Init npmsw specific variables within url data"""
@@ -126,6 +123,9 @@ class NpmShrinkWrap(FetchMethod):
extrapaths.append(resolvefile)
# Handle http tarball sources
+ elif resolved is None:
+ raise ParameterError("Missing 'resolved' field for dependency '%s'" % name, ud.url)
+
elif resolved.startswith("http") and integrity:
localfile = npm_localfile(os.path.basename(resolved))
The npmsw fetcher was disabled in 355cd226 (Jan 2026) along with the npm fetcher, but its security model is already correct: checksums come from the locally-committed npm-shrinkwrap.json file, not from the network. Re-enable it with the following fixes: - Add the missing FetchError import that would cause a NameError on malformed shrinkwrap files. - Change 'if not packages' to 'if packages is None' in foreach_dependencies so a valid zero-dependency shrinkwrap (packages={}) no longer raises FetchError. - Add 'elif resolved is None' guard before the startswith chain in _resolve_dependency so missing 'resolved' fields raise ParameterError instead of AttributeError. [YOCTO #16105] Fixes: 355cd226e072 ("fetch2/npm: Disable npm/npmsw fetchers due to security issues") Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> --- lib/bb/fetch2/npmsw.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)