imjasonh/terraform-playground
1
0
Fork 0
mirror of https://github.com/imjasonh/terraform-playground synced 2026-07-22 08:01:06 +00:00
Code Activity

wheelhouse: gate sdist building behind --build-sdists opt-in (RCE risk, single-arch)

Browse source 
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
This commit is contained in:
Cursor Agent 2026-06-11 01:42:11 +00:00
parent f0ba6e3f41
commit 872abd1ef7
No known key found for this signature in database
6 changed files with 46 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
pymage/internal/cli/cli.go
View file

@ -72,6 +72,7 @@ type buildFlags struct {
insecure bool
cacheDir string
noCache bool
buildSdists bool
}
func buildCmd() *cobra.Command {
@ -119,6 +120,7 @@ func buildCmd() *cobra.Command {
fs.BoolVar(&f.insecure, "insecure", false, "use plain HTTP for the registry")
fs.StringVar(&f.cacheDir, "cache-dir", "", "cache root directory (default: per-user cache dir)")
fs.BoolVar(&f.noCache, "no-cache", false, "disable all build caches (layers, downloaded wheels, interpreter detection)")
fs.BoolVar(&f.buildSdists, "build-sdists", false, "allow building wheels from source distributions when no compatible wheel exists (runs the dependency's build code on this host; single-arch for compiled packages)")
return cmd
}
@ -256,7 +258,7 @@ func buildOne(ctx context.Context, f *buildFlags, lk *lock.Lock, platform *v1.Pl
return nil, nil, err
}
wheels, err := wheelhouse.ResolveContext(ctx, reqs, f.findLinks, target, wheelCache)
wheels, err := wheelhouse.ResolveContext(ctx, reqs, f.findLinks, target, wheelCache, f.buildSdists)
if err != nil {
return nil, nil, err
}