diff mbox series

npmsw.py: Handle local tarball before registry

Message ID 20260623191729.761661-1-john.ripple@keysight.com
State New
Headers show
Series npmsw.py: Handle local tarball before registry | expand

Commit Message

John Ripple June 23, 2026, 7:17 p.m. UTC 
The local tarball source must be checked before the registry sources
because a local package can have a semver version and integrity field
which would otherwise incorrectly match the registry sources branch
producing a file:// proxy URL whose local.py fetcher leaves
lockfile=None and eventually throws an error.

This patch was based on the npm and npmsw fetchers with the improved
security from Thomas Perrot's patches https://lists.openembedded.org/g/bitbake-devel/message/19705.

Signed-off-by: John Ripple <john.ripple@keysight.com>
---
 lib/bb/fetch2/npmsw.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/lib/bb/fetch2/npmsw.py b/lib/bb/fetch2/npmsw.py
index f09ea5794..122af4582 100644
--- a/lib/bb/fetch2/npmsw.py
+++ b/lib/bb/fetch2/npmsw.py
@@ -93,6 +93,10 @@  class NpmShrinkWrap(FetchMethod):
             if link:
                 localpath = resolved
                 unpack = False
+            
+            # Handle local tarball sources
+            elif resolved and resolved.startswith("file"):
+                localpath = resolved[5:]
 
             # Handle registry sources
             elif version and is_semver(version) and integrity:
@@ -139,10 +143,6 @@  class NpmShrinkWrap(FetchMethod):
 
                 localpath = os.path.join(d.getVar("DL_DIR"), localfile)
 
-            # Handle local tarball sources
-            elif resolved.startswith("file"):
-                localpath = resolved[5:]
-
             # Handle git sources
             elif resolved.startswith("git"):
                 regex = re.compile(r"""