From f3feffcfc77f14f35b9713fbc18b374877a26063 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Mon, 6 Jul 2026 20:34:26 +0200 Subject: [PATCH 1/4] security: pin pip installs in docs setup-dev.sh Add --uploaded-prior-to=P1D to the pip installs in the docs-website dev setup script to guard against freshly-uploaded (potentially malicious) package versions, matching the pattern already used across CI workflows. Upgrade pip first so the flag is available on older local pip versions. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs-website/scripts/setup-dev.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs-website/scripts/setup-dev.sh b/docs-website/scripts/setup-dev.sh index 2eb4ceb0e05..44a67b44d30 100755 --- a/docs-website/scripts/setup-dev.sh +++ b/docs-website/scripts/setup-dev.sh @@ -22,11 +22,16 @@ if ! command -v python &> /dev/null; then exit 1 fi +# Upgrade pip so that the --uploaded-prior-to supply-chain flag is available +echo "⬆️ Upgrading pip..." +python -m pip install --upgrade pip + # Check if base dependencies are installed echo "📦 Checking base dependencies..." python -c "import requests, toml" 2>/dev/null || { echo "⚠️ Installing base dependencies (requests, toml)..." - pip install requests toml + # --uploaded-prior-to=P1D avoids versions uploaded in the last day (supply-chain guard) + pip install requests toml --uploaded-prior-to=P1D } # Get Haystack version (default to main) @@ -46,7 +51,7 @@ echo "📋 Generated requirements.txt with $(wc -l < requirements.txt) dependenc # Install dependencies echo "⚙️ Installing dependencies..." -pip install -r requirements.txt +pip install -r requirements.txt --uploaded-prior-to=P1D echo "✅ Setup complete! You can now run:" echo " python scripts/test_python_snippets.py --verbose" From 09a82f0a60a03a83cd037dd930fe6ac4f3bb9e55 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Mon, 6 Jul 2026 20:36:08 +0200 Subject: [PATCH 2/4] security: pin dependency resolution in clusterfuzzlite build Add --uploaded-prior-to=P1D to the pip install in the ClusterFuzzLite build script so transitive dependencies resolved during the fuzz build skip freshly-uploaded (potentially malicious) versions. Upgrade pip first since the OSS-Fuzz base-builder image may ship an older pip. Co-Authored-By: Claude Opus 4.8 (1M context) --- .clusterfuzzlite/build.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh index e2ceb32130c..103200e8012 100755 --- a/.clusterfuzzlite/build.sh +++ b/.clusterfuzzlite/build.sh @@ -6,7 +6,11 @@ # Builds the Atheris fuzz targets for ClusterFuzzLite / OSS-Fuzz. # `compile_python_fuzzer` is provided by the base-builder-python image. -pip3 install . +# Upgrade pip so that the --uploaded-prior-to supply-chain flag is available +python3 -m pip install --upgrade pip +# --uploaded-prior-to=P1D restricts dependency resolution to versions uploaded +# more than a day ago, guarding against freshly-uploaded (potentially malicious) releases +pip3 install . --uploaded-prior-to=P1D for harness in "$SRC"/haystack/test/fuzz/fuzz_*.py; do name=$(basename "$harness" .py) From abfa5c2c9bb459e6e5d4abdf07e18fce491e2ccd Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Mon, 6 Jul 2026 20:36:57 +0200 Subject: [PATCH 3/4] Clean up comments in build.sh Removed comments about pip upgrade and supply-chain flag. --- .clusterfuzzlite/build.sh | 3 --- 1 file changed, 3 deletions(-) diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh index 103200e8012..598b6f77813 100755 --- a/.clusterfuzzlite/build.sh +++ b/.clusterfuzzlite/build.sh @@ -6,10 +6,7 @@ # Builds the Atheris fuzz targets for ClusterFuzzLite / OSS-Fuzz. # `compile_python_fuzzer` is provided by the base-builder-python image. -# Upgrade pip so that the --uploaded-prior-to supply-chain flag is available python3 -m pip install --upgrade pip -# --uploaded-prior-to=P1D restricts dependency resolution to versions uploaded -# more than a day ago, guarding against freshly-uploaded (potentially malicious) releases pip3 install . --uploaded-prior-to=P1D for harness in "$SRC"/haystack/test/fuzz/fuzz_*.py; do From 5c0ed5ed2ccff1b1e3c2aac536282ed653cb24e4 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Mon, 6 Jul 2026 20:37:42 +0200 Subject: [PATCH 4/4] Remove unnecessary comment in setup-dev.sh Removed comment about upgrading pip for supply-chain flag. --- docs-website/scripts/setup-dev.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs-website/scripts/setup-dev.sh b/docs-website/scripts/setup-dev.sh index 44a67b44d30..5ecc3d432c3 100755 --- a/docs-website/scripts/setup-dev.sh +++ b/docs-website/scripts/setup-dev.sh @@ -22,7 +22,6 @@ if ! command -v python &> /dev/null; then exit 1 fi -# Upgrade pip so that the --uploaded-prior-to supply-chain flag is available echo "⬆️ Upgrading pip..." python -m pip install --upgrade pip @@ -30,7 +29,6 @@ python -m pip install --upgrade pip echo "📦 Checking base dependencies..." python -c "import requests, toml" 2>/dev/null || { echo "⚠️ Installing base dependencies (requests, toml)..." - # --uploaded-prior-to=P1D avoids versions uploaded in the last day (supply-chain guard) pip install requests toml --uploaded-prior-to=P1D }