Six workflow steps installed whatever PyPI served that day: cryptography
(wai-conformance, wai-http twice, wai-web-wasm), the RDF tools' dependencies
(wai-conformance), PyYAML (standards-build, aac-rs), the ML stack of
wai-neural-e2e, and pip itself (wai-neural-e2e, wai-sota-vectors). A
compromised release would have run on the runners. Each now installs a
hashed requirements file with --require-hashes, the way wai-pack.yml
already does:
- cryptography: wai/pack-conformance/requirements-verify.txt (the same file);
- RDF tools: wai/vocab/requirements-shapes.txt, from requirements-shapes.in;
- PyYAML: aac/aac-rs/tools/pagesets/requirements-ci.txt, from requirements-ci.in;
- wai-neural-e2e: wai/tools/requirements-neural-e2e.txt, from
requirements-neural-e2e.in;
- wai-sota-vectors: wai/tools/requirements-sota-int-hashes.txt, from
requirements-sota-int.txt.
Each generated file's header holds the uv command that regenerates it. The
two ML locks take torch and torchvision from the CPU wheel index through
wai/tools/torch-cpu-overrides.txt (2.14.0+cpu on Linux, 2.14.0 on macOS),
with no CUDA packages. The new lock files are added to the path filters of
the workflows that install them.
pillow goes from 12.3.0 to 13.0.0 in requirements-sota-int.txt: 12.x has
heap overflows in the TIFF writer and the JPEG decoder and an argument
injection into Ghostscript (GHSA-332p-7hrc-92wf, GHSA-8g5g-8vmr-9782,
GHSA-w889-685w-c8fh); 13.0.0 is the first fixed release.
The 26 verifier and differential calls that ran without -I now run with it,
so neither the working directory nor PYTHON* variables can put a module in
front of the standard library: pin, int_payload, staged, http (4), measure,
sim, sim_diff, claim, differential, jwp, chain and chain-gap differentials,
signer (2), check_shapes, smart-byte verify_v1, pack_verify and the five pack
differentials (7). Each script already puts its own directory on sys.path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
48eaa9a587