File scanning: validate wheel digests against pypi.org #199

Merged
Oleg-Komarov merged 5 commits from validate-wheels into main 2024-07-11 10:45:24 +02:00
2 changed files with 16 additions and 13 deletions
Showing only changes of commit c6ef475c00 - Show all commits

View File

@ -20,9 +20,8 @@ def scan_file(file_id: int):
logger.info('File pk=%s scanned by clamd: %s', file.pk, (clamd_scan_status, clamd_scan_found))
scan_result = {'clamdscan': [clamd_scan_status, clamd_scan_found]}
is_ok = clamd_scan_status == 'OK'
if is_ok and (wheels := file.metadata.get('wheels', None)):
invalid_wheels = files.utils.validate_wheels(abs_path, wheels)
if invalid_wheels:
if is_ok and (wheels := files.utils.get_wheels_from_manifest(file.metadata)):
if invalid_wheels := files.utils.validate_wheels(abs_path, wheels):
logger.info('File pk=%s has invalid wheels: %s', file.pk, invalid_wheels)
is_ok = False
scan_result['invalid_wheels'] = invalid_wheels

View File

@ -171,6 +171,19 @@ def find_forbidden_filepaths(file_list):
return result
def get_wheels_from_manifest(manifest):
wheels = None
if (
'build' in manifest
and 'generated' in manifest['build']
and 'wheels' in manifest['build']['generated']
):
wheels = manifest['build']['generated']['wheels']
else:
wheels = manifest.get('wheels')
return wheels
def validate_file_list(toml_content, manifest_filepath, file_list):
"""Check the files in in the archive against manifest."""
error_codes = []
@ -196,16 +209,7 @@ def validate_file_list(toml_content, manifest_filepath, file_list):
init_filepath = find_exact_path(file_list, expected_init_path)
if not init_filepath:
error_codes.append('invalid_missing_init')
wheels = None
if (
'build' in toml_content
and 'generated' in toml_content['build']
and 'wheels' in toml_content['build']['generated']
):
wheels = toml_content['build']['generated']['wheels']
else:
wheels = toml_content.get('wheels')
if wheels:
if wheels := get_wheels_from_manifest(toml_content):
for wheel in wheels:
expected_wheel_path = _canonical_path(wheel, manifest_filepath)
wheel_filepath = find_exact_path(file_list, expected_wheel_path)