Upgrade xapian to 1.4.31 and add sha256 check to avoid supply chain attack

core/management/commands/install_xapian.py

@@ -39,12 +39,16 @@ class Command(BaseCommand):
             return None
         return xapian.version_string()
 
-    def _desired_version(self) -> str:
+    def _desired_version(self) -> tuple[str, str, str]:
         with open(
             Path(__file__).parent.parent.parent.parent / "pyproject.toml", "rb"
         ) as f:
             pyproject = tomli.load(f)
-            return pyproject["tool"]["xapian"]["version"]
+            return (
+                pyproject["tool"]["xapian"]["version"],
+                pyproject["tool"]["xapian"]["core-sha256"],
+                pyproject["tool"]["xapian"]["bindings-sha256"],
+            )
 
     def handle(self, *args, force: bool, **options):
         if not os.environ.get("VIRTUAL_ENV", None):
@@ -53,7 +57,7 @@ class Command(BaseCommand):
             )
             return
 
-        desired = self._desired_version()
+        desired, core_checksum, bindings_checksum = self._desired_version()
         if desired == self._current_version():
             if not force:
                 self.stdout.write(
@@ -65,7 +69,12 @@ class Command(BaseCommand):
             f"Installing xapian version {desired} at {os.environ['VIRTUAL_ENV']}"
         )
         subprocess.run(
-            [str(Path(__file__).parent / "install_xapian.sh"), desired],
+            [
+                str(Path(__file__).parent / "install_xapian.sh"),
+                desired,
+                core_checksum,
+                bindings_checksum,
+            ],
             env=dict(os.environ),
             check=True,
         )

core/management/commands/install_xapian.sh

@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
 # Originates from https://gist.github.com/jorgecarleitao/ab6246c86c936b9c55fd
 # first argument of the script is Xapian version (e.g. 1.2.19)
+# second argument of the script is core sha256
+# second argument of the script is binding sha256
 VERSION="$1"
+CORE_SHA256="$2"
+BINDINGS_SHA256="$3"
 
 # Cleanup env vars for auto discovery mechanism
 unset CPATH
@@ -21,9 +25,15 @@ BINDINGS=xapian-bindings-$VERSION
 
 # download
 echo "Downloading source..."
-curl -O "https://oligarchy.co.uk/xapian/$VERSION/${CORE}.tar.xz"
+curl -O "https://oligarchy.co.uk/xapian/$VERSION/${CORE}.tar.xz" || exit 1
+
+echo "${CORE_SHA256}  ${CORE}.tar.xz" | sha256sum -c - || exit 1
+
 curl -O "https://oligarchy.co.uk/xapian/$VERSION/${BINDINGS}.tar.xz"
 
+echo "${BINDINGS_SHA256}  ${BINDINGS}.tar.xz" | sha256sum -c - || exit 1
+
+
 # extract
 echo "Extracting source..."
 tar xf "${CORE}.tar.xz"

pyproject.toml

@@ -4,54 +4,54 @@ version = "3"
 description = "Le web Sith de l'AE"
 readme = "README.md"
 authors = [
-    { name = "Skia", email = "skia@hya.sk" },
-    { name = "klmp200", email = "antoine@bartuccio.fr" },
-    { name = "Krophil", email = "pierre.brunet@krophil.fr" },
-    { name = "Maréchal", email = "thgirod@hotmail.com" },
-    { name = "Och", email = "francescowitz68@gmail.com" },
-    { name = "tleb", email = "tleb@openmailbox.org" },
-    { name = "Soldat", email = "ryan-68@live.fr" },
-    { name = "Nabos", email = "gnikwo@hotmail.com" },
-    { name = "Terre", email = "jbaptiste.lenglet+git@gmail.com" },
-    { name = "Lo-J", email = "renaudg779@gmail.com" },
-    { name = "Vial", email = "robin.trioux@utbm.fr" },
+  { name = "Skia", email = "skia@hya.sk" },
+  { name = "klmp200", email = "antoine@bartuccio.fr" },
+  { name = "Krophil", email = "pierre.brunet@krophil.fr" },
+  { name = "Maréchal", email = "thgirod@hotmail.com" },
+  { name = "Och", email = "francescowitz68@gmail.com" },
+  { name = "tleb", email = "tleb@openmailbox.org" },
+  { name = "Soldat", email = "ryan-68@live.fr" },
+  { name = "Nabos", email = "gnikwo@hotmail.com" },
+  { name = "Terre", email = "jbaptiste.lenglet+git@gmail.com" },
+  { name = "Lo-J", email = "renaudg779@gmail.com" },
+  { name = "Vial", email = "robin.trioux@utbm.fr" },
 ]
 license = { text = "GPL-3.0-only" }
 requires-python = "<4.0,>=3.12"
 dependencies = [
-    "django>=5.2.12,<6.0.0",
-    "django-ninja>=1.5.3,<6.0.0",
-    "django-ninja-extra>=0.31.0",
-    "Pillow>=12.1.1,<13.0.0",
-    "mistune>=3.2.0,<4.0.0",
-    "django-jinja<3.0.0,>=2.11.0",
-    "cryptography>=46.0.5,<47.0.0",
-    "django-phonenumber-field>=8.4.0,<9.0.0",
-    "phonenumbers>=9.0.25,<10.0.0",
-    "reportlab>=4.4.10,<5.0.0",
-    "django-haystack<4.0.0,>=3.3.0",
-    "xapian-haystack<4.0.0,>=3.1.0",
-    "libsass<1.0.0,>=0.23.0",
-    "django-ordered-model<4.0.0,>=3.7.4",
-    "django-simple-captcha<1.0.0,>=0.6.3",
-    "python-dateutil<3.0.0.0,>=2.9.0.post0",
-    "sentry-sdk>=2.54.0,<3.0.0",
-    "jinja2<4.0.0,>=3.1.6",
-    "django-countries>=8.2.0,<9.0.0",
-    "dict2xml>=1.7.8,<2.0.0",
-    "Sphinx<6,>=5",
-    "tomli>=2.4.0,<3.0.0",
-    "django-honeypot>=1.3.0,<2",
-    "pydantic-extra-types>=2.11.0,<3.0.0",
-    "ical>=11.1.0,<12",
-    "redis[hiredis]>=5.3.0,<8.0.0",
-    "environs[django]>=14.5.0,<15.0.0",
-    "requests>=2.32.5,<3.0.0",
-    "honcho>=2.0.0",
-    "psutil>=7.2.2,<8.0.0",
-    "celery[redis]>=5.6.2,<7",
-    "django-celery-results>=2.5.1",
-    "django-celery-beat>=2.9.0",
+  "django>=5.2.12,<6.0.0",
+  "django-ninja>=1.5.3,<6.0.0",
+  "django-ninja-extra>=0.31.0",
+  "Pillow>=12.1.1,<13.0.0",
+  "mistune>=3.2.0,<4.0.0",
+  "django-jinja<3.0.0,>=2.11.0",
+  "cryptography>=46.0.5,<47.0.0",
+  "django-phonenumber-field>=8.4.0,<9.0.0",
+  "phonenumbers>=9.0.25,<10.0.0",
+  "reportlab>=4.4.10,<5.0.0",
+  "django-haystack<4.0.0,>=3.3.0",
+  "xapian-haystack<4.0.0,>=3.1.0",
+  "libsass<1.0.0,>=0.23.0",
+  "django-ordered-model<4.0.0,>=3.7.4",
+  "django-simple-captcha<1.0.0,>=0.6.3",
+  "python-dateutil<3.0.0.0,>=2.9.0.post0",
+  "sentry-sdk>=2.54.0,<3.0.0",
+  "jinja2<4.0.0,>=3.1.6",
+  "django-countries>=8.2.0,<9.0.0",
+  "dict2xml>=1.7.8,<2.0.0",
+  "Sphinx<6,>=5",
+  "tomli>=2.4.0,<3.0.0",
+  "django-honeypot>=1.3.0,<2",
+  "pydantic-extra-types>=2.11.0,<3.0.0",
+  "ical>=11.1.0,<12",
+  "redis[hiredis]>=5.3.0,<8.0.0",
+  "environs[django]>=14.5.0,<15.0.0",
+  "requests>=2.32.5,<3.0.0",
+  "honcho>=2.0.0",
+  "psutil>=7.2.2,<8.0.0",
+  "celery[redis]>=5.6.2,<7",
+  "django-celery-results>=2.5.1",
+  "django-celery-beat>=2.9.0",
 ]
 
 [project.urls]
@@ -59,73 +59,74 @@ homepage = "https://ae.utbm.fr/"
 documentation = "https://sith-ae.readthedocs.io/"
 
 [dependency-groups]
-prod = [
-    "psycopg[c]>=3.3.3,<4.0.0",
-]
+prod = ["psycopg[c]>=3.3.3,<4.0.0"]
 dev = [
-    "django-debug-toolbar>=6.2.0,<7",
-    "ipython>=9.11.0,<10.0.0",
-    "pre-commit>=4.5.1,<5.0.0",
-    "ruff>=0.15.5,<1.0.0",
-    "djhtml>=3.0.10,<4.0.0",
-    "faker>=40.8.0,<41.0.0",
-    "rjsmin>=1.2.5,<2.0.0",
+  "django-debug-toolbar>=6.2.0,<7",
+  "ipython>=9.11.0,<10.0.0",
+  "pre-commit>=4.5.1,<5.0.0",
+  "ruff>=0.15.5,<1.0.0",
+  "djhtml>=3.0.10,<4.0.0",
+  "faker>=40.8.0,<41.0.0",
+  "rjsmin>=1.2.5,<2.0.0",
 ]
 tests = [
-    "freezegun>=1.5.5,<2.0.0",
-    "pytest>=9.0.2,<10.0.0",
-    "pytest-cov>=7.0.0,<8.0.0",
-    "pytest-django<5.0.0,>=4.12.0",
-    "model-bakery<2.0.0,>=1.23.3",
-    "beautifulsoup4>=4.14.3,<5",
-    "lxml>=6.0.2,<7",
+  "freezegun>=1.5.5,<2.0.0",
+  "pytest>=9.0.2,<10.0.0",
+  "pytest-cov>=7.0.0,<8.0.0",
+  "pytest-django<5.0.0,>=4.12.0",
+  "model-bakery<2.0.0,>=1.23.3",
+  "beautifulsoup4>=4.14.3,<5",
+  "lxml>=6.0.2,<7",
 ]
 docs = [
-    "mkdocs<2.0.0,>=1.6.1",
-    "mkdocs-material>=9.7.5,<10.0.0",
-    "mkdocstrings>=1.0.3,<2.0.0",
-    "mkdocstrings-python>=2.0.3,<3.0.0",
-    "mkdocs-include-markdown-plugin>=7.2.1,<8.0.0",
+  "mkdocs<2.0.0,>=1.6.1",
+  "mkdocs-material>=9.7.5,<10.0.0",
+  "mkdocstrings>=1.0.3,<2.0.0",
+  "mkdocstrings-python>=2.0.3,<3.0.0",
+  "mkdocs-include-markdown-plugin>=7.2.1,<8.0.0",
 ]
 
 [tool.uv]
 default-groups = ["dev", "tests", "docs"]
 
 [tool.xapian]
-version = "1.4.29"
+version = "1.4.31"
+core-sha256 = "fecf609ea2efdc8a64be369715aac733336a11f7480a6545244964ae6bc80811"
+bindings-sha256 = "a38cc7ba4188cc0bd27dc7369f03906772047087a1c54f1b93355d5e9103c304"
+
 
 [tool.ruff]
 output-format = "concise" # makes ruff error logs easier to read
 
 [tool.ruff.lint]
 select = [
-    "A", # shadowing of Python builtins
-    "B",
-    "C4", # use comprehensions when possible
-    "DJ", # django-specific rules,
-    "E", # pycodestyle (https://docs.astral.sh/ruff/rules/#pycodestyle-e-w)
-    "ERA", # commented code
-    "F", # pyflakes (https://docs.astral.sh/ruff/rules/#pyflakes-f)
-    "FBT", # boolean trap
-    "FLY", # f-string instead of str.join
-    "FURB", # https://docs.astral.sh/ruff/rules/#refurb-furb
-    "I", # isort
-    "INT", # gettext
-    "PERF", # performance
-    "PLW", # pylint warnings (https://docs.astral.sh/ruff/rules/#pylint-pl)
-    "RUF", # Ruff specific rules
-    "SIM", # simplify (https://docs.astral.sh/ruff/rules/#flake8-simplify-sim)
-    "T100", # breakpoint()
-    "T2", # print statements
-    "TCH", # type-checking block
-    "UP008", # Use super() instead of super(__class__, self)
-    "UP009", # utf-8 encoding declaration is unnecessary
+  "A",     # shadowing of Python builtins
+  "B",
+  "C4",    # use comprehensions when possible
+  "DJ",    # django-specific rules,
+  "E",     # pycodestyle (https://docs.astral.sh/ruff/rules/#pycodestyle-e-w)
+  "ERA",   # commented code
+  "F",     # pyflakes (https://docs.astral.sh/ruff/rules/#pyflakes-f)
+  "FBT",   # boolean trap
+  "FLY",   # f-string instead of str.join
+  "FURB",  # https://docs.astral.sh/ruff/rules/#refurb-furb
+  "I",     # isort
+  "INT",   # gettext
+  "PERF",  # performance
+  "PLW",   # pylint warnings (https://docs.astral.sh/ruff/rules/#pylint-pl)
+  "RUF",   # Ruff specific rules
+  "SIM",   # simplify (https://docs.astral.sh/ruff/rules/#flake8-simplify-sim)
+  "T100",  # breakpoint()
+  "T2",    # print statements
+  "TCH",   # type-checking block
+  "UP008", # Use super() instead of super(__class__, self)
+  "UP009", # utf-8 encoding declaration is unnecessary
 ]
 
 ignore = [
-    "DJ001", # null=True in CharField/TextField. this one would require a migration
-    "E501", # line too long. The rule is too harsh, and the formatter deals with it in most cases
-    "RUF012"  # mutable class attributes. This rule doesn't integrate well with django
+  "DJ001",  # null=True in CharField/TextField. this one would require a migration
+  "E501",   # line too long. The rule is too harsh, and the formatter deals with it in most cases
+  "RUF012", # mutable class attributes. This rule doesn't integrate well with django
 ]
 
 [tool.ruff.lint.pydocstyle]
@@ -141,4 +142,4 @@ sith = "sith.pytest"
 [tool.pytest.ini_options]
 DJANGO_SETTINGS_MODULE = "sith.settings"
 python_files = ["tests.py", "test_*.py", "*_tests.py"]
-markers = ["slow"]
+markers = ["slow"]