3 ms·
> But nowadays prefer pyproject.toml Couldn't you accomplish the same thing by adding a malicious [build-system] to a pyproject.toml file? You can pull in arb
by optionalsquid 5mo ago
> But nowadays prefer pyproject.toml
Couldn't you accomplish the same thing by adding a malicious [build-system] to a pyproject.toml file? You can pull in arbitrary code by providing exact URLs for requirements:
[build-system]
requires = ["hatchling @ https://files.pythonhosted.org/packages/8f/8a/cc1debe3514da292094f1c3a700e4ca25442489731ef7c0814358816bb03/hatchling-1.27.0.tar.gz"]
build-backend = "hatchling.build"
- amiga386 5mo agoThat's a very visible Ken Thompson style attack. The modern expectation is that PyPI would be evaluating this build-system section and would only accept build-systems that they trust to turn package distributions into wheels, and the end users only need the wheels. If you need a specific version of hatchling that they know of, that's fine. If you need something they haven't heard of, they should say no.