Bug 1259551 - Add --no-download to virtualenv.py invocation; r?ted draft
authorGregory Szorc <gps@mozilla.com>
Thu, 24 Mar 2016 12:34:47 -0700
changeset 344511 4292e1200322627cde987a0d61355388ca27316a
parent 344510 ea2bc60868bb39c1f5bf97f19bdfb1d600ad0e9c
child 516973 ebf5f61fe393492d5f0eab2869b678f36ac08c55
push id13843
push usergszorc@mozilla.com
push dateThu, 24 Mar 2016 19:35:18 +0000
Bug 1259551 - Add --no-download to virtualenv.py invocation; r?ted Before, virtualenv.py may have attempted to use 3rd party (untrusted) pip indices when installing wheels for pip, setuptools, and wheel. These dependencies are vendored in the tree for a reason. So don't let virtualenv contact the outside world. MozReview-Commit-ID: 6BCU0WegJO1
--- a/python/mozbuild/mozbuild/virtualenv.py
+++ b/python/mozbuild/mozbuild/virtualenv.py
@@ -168,16 +168,21 @@ class VirtualenvManager(object):
         Receives the path to virtualenv's virtualenv.py script (which will be
         called out to), the path to create the virtualenv in, and a handle to
         write output to.
         env = dict(os.environ)
         env.pop('PYTHONDONTWRITEBYTECODE', None)
         args = [python, self.virtualenv_script_path,
+            # Without this, virtualenv.py may attempt to contact the outside
+            # world and search for or download a newer version of pip,
+            # setuptools, or wheel. This is bad for security, reproducibility,
+            # and speed.
+            '--no-download',
         result = subprocess.call(args, stdout=self.log_handle,
             stderr=subprocess.STDOUT, env=env)
         if result:
             raise Exception(
                 'Failed to create virtualenv: %s' % self.virtualenv_root)