Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't trust link hash in direct URL dependencies #11938

Merged
merged 3 commits into from
Apr 10, 2023
Merged

Don't trust link hash in direct URL dependencies #11938

merged 3 commits into from
Apr 10, 2023

Commits on Apr 10, 2023

  1. Add tests about link hashes validation

    @sbidoul
    sbidoul committed Apr 10, 2023
    Configuration menu
    Copy the full SHA
    0ffc54d View commit details
    Browse the repository at this point in the history

  2. Fix --require-hashes trusting link hashes 

    When a direct URL with hash is provided as a dependency, --require-hash
incorrectly considered the link hash as trusted.
    @sbidoul
    sbidoul committed Apr 10, 2023
    Configuration menu
    Copy the full SHA
    f5f0302 View commit details
    Browse the repository at this point in the history

  3. Add test for combination of invalid link hash and good --hash

    @sbidoul
    sbidoul committed Apr 10, 2023
    Configuration menu
    Copy the full SHA
    453a5a7 View commit details
    Browse the repository at this point in the history