Skip to content

Commit

Permalink
Remove embedded wheels supporting python3.7 (CVE-2024-6345)
Browse files Browse the repository at this point in the history
These wheels are from python 3.7.

This will stop scanner from reporting CVE-2024-634
and save 3MB of space.

See also pypa/virtualenv#2758
  • Loading branch information
smoser committed Sep 5, 2024
1 parent 15c852c commit f0564c4
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion py3-virtualenv.yaml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
package:
name: py3-virtualenv
version: 20.26.3
epoch: 1
epoch: 3
description: Virtual Python Environment builder
copyright:
- license: "MIT"
Expand Down Expand Up @@ -50,6 +50,15 @@ subpackages:
- uses: py/pip-build-install
with:
python: python${{range.key}}
- name: Remove embedded setuptools wheel for python3.7 (CVE-2024-6345)
runs: |
# https://github.com/pypa/virtualenv/issues/2758
cd ${{targets.contextdir}}/usr/lib/python${{range.key}}/site-packages/virtualenv/seed/wheels/embed/
rm -v \
pip-24.0-py3-none-any.whl \
setuptools-68.0.0-py3-none-any.whl \
wheel-0.42.0-py3-none-any.whl
- uses: strip
test:
pipeline:
Expand Down

0 comments on commit f0564c4

Please sign in to comment.