Skip to content

SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh #139330

Closed
Closed
SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh#139330
Assignees
sethmlarson
Labels
3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixestopic-XMLtriagedThe issue has been accepted as valid by a triager.type-securityA security issue

Description

@sethmlarson
sethmlarson
opened on Sep 25, 2025

Bug report

Bug description:

There's a bad comparison against the magic string == "libexpat" where it should check against == "expat" for the package name. This means that SBOM data for expat doesn't get cross-checked automatically against the refresh.sh script.

Found while reviewing #139319

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Activity

  1. sethmlarson
    added
    type-bugAn unexpected behavior, bug, or error
    on Sep 25, 2025
  2. sethmlarson
    self-assigned this
    on Sep 25, 2025
  3. StanFromIreland
    added
    type-securityA security issue
    triagedThe issue has been accepted as valid by a triager.
    topic-XML
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    3.15bugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or error
    on Sep 25, 2025
  4. sethmlarson
    added a commit that references this issue on Sep 25, 2025

    gh-139330: Check expat version/checksum in SBOM with refresh.sh

    89b5571
  5. miss-islington
    added 3 commits that reference this issue on Sep 25, 2025

    pythongh-139330: Check expat version/checksum in SBOM with refresh.sh

    4d5aa40

    pythongh-139330: Check expat version/checksum in SBOM with refresh.sh

    62d988e

    pythongh-139330: Check expat version/checksum in SBOM with refresh.sh

    a303f92
  6. sethmlarson
    added 4 commits that reference this issue on Sep 25, 2025

    [3.13] gh-139330: Check expat version/checksum in SBOM with refresh.sh

    11d6c46

    [3.12] pythongh-139330: Check expat version/checksum in SBOM with ref…

    fe60c9a

    [3.14] gh-139330: Check expat version/checksum in SBOM with refresh.sh

    7519ac2

    [3.12] gh-139330: Check expat version/checksum in SBOM with refresh.sh

    ade85bc

  7. sethmlarson commented on Sep 26, 2025

    @sethmlarson
    sethmlarson
    on Sep 26, 2025
    ContributorAuthor

    All backports merged, closing!

  8. sethmlarson
    closed this as completedon Sep 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixestopic-XMLtriagedThe issue has been accepted as valid by a triager.type-securityA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions