Repository navigation
Prove the exact pip slice for namespace-wheel advisory - #367
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first v0.3.7 base candidate correctly stopped on GHSA-xmj3-9gf7-h52w. The official fix changes setuptools/wheel.py; the pinned pip wheel contains only pkg_resources and has no such module. Extend the existing code-absence proof for this single advisory, requiring the exact 299-file inventory hash, actual wheel/live module absence, exact SBOM-analyzed package PURL, and native CycloneDX bytes. Full setuptools distributions, unknown IDs/versions/PURLs and incomplete evidence remain blocked.
The original raw scan remains untouched. Separately, cleanup now checks the canonical private mktemp path before repairing ownership of only its root-owned Trivy cache; scan UID, networking and flags are unchanged.
Validation: 8 focused tests, including real wheel/live file-presence controls and missing/tampered inventory/SBOM/PURL controls; real pinned wheel plus retained failed native proof/SBOM replay leaves all 21 vendor-unfixed Medium/Low findings and no blocking finding. Bash syntax and private-path cleanup controls pass. The original failed run/artifact is retained; a new protected publisher must still generate and verify its actual runtime inventory.
Official advisory: GHSA-xmj3-9gf7-h52w
Official fix: pypa/setuptools@6d07b8d