From 722a5b8efa19fd54728af462441dce08cd7e545b Mon Sep 17 00:00:00 2001 From: Jeffery To Date: Sat, 15 Aug 2020 14:33:30 +0800 Subject: python3: Use hash-checking mode when installing host pip packages In hash-checking mode[1], pip will verify downloaded package archives (source tarballs in our case) against known SHA256 hashes before installing the packages. As a consequence, this requires the use of requirements files[2] and pinning packages to known versions. The syntax for package Makefiles has changed slightly; HOST_PYTHON3_PACKAGE_BUILD_DEPENDS no longer accepts requirement specifiers like "foo>=1.0", only requirements file names (which are the same as package names in the most common case). This also updates affected packages, in particular: * python-zipp: "setuptools_scm[toml]" has been split into "setuptools-scm toml" to reuse the requirements file for setuptools-scm (the extra depends installed by "setuptools_scm[toml]" is toml). * python-pycparser: This previously used ply 3.10, whereas the requirements file will now install 3.11. [1]: https://pip.pypa.io/en/stable/reference/pip_install/#hash-checking-mode [2]: https://pip.pypa.io/en/stable/user_guide/#requirements-files Signed-off-by: Jeffery To --- lang/python/python3-host.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lang/python/python3-host.mk') diff --git a/lang/python/python3-host.mk b/lang/python/python3-host.mk index f5016ed57..9dd5e13c4 100644 --- a/lang/python/python3-host.mk +++ b/lang/python/python3-host.mk @@ -55,10 +55,11 @@ HOST_PYTHON3_PIP_CACHE_DIR:=$(DL_DIR)/pip-cache define HostPython3/PipInstall $(HOST_PYTHON3_VARS) \ $(HOST_PYTHON3_PIP) \ - --disable-pip-version-check \ --cache-dir "$(HOST_PYTHON3_PIP_CACHE_DIR)" \ + --disable-pip-version-check \ install \ --no-binary :all: \ + --require-hashes \ $(1) ifdef CONFIG_PYTHON3_HOST_PIP_CACHE_WORLD_READABLE $(FIND) $(HOST_PYTHON3_PIP_CACHE_DIR) -not -type d -exec chmod go+r '{}' \; -- cgit