Skip to content

Commit c003b8e

Browse files
NXP Backend: Use --index-url for eiq.nxp.com/repository (#13759)
### Summary Avoid attack on PyPI index. If `--extra-index-url` is used there is an attack vector when adversary publish a malicious package with same name on pypi.org. And pip might pick the malicious package instead of one on eiq.nxp.com/repository, as "there is no priority in the locations that are searched" [https://pip.pypa.io/en/stable/cli/pip_install/] Using --index-url eliminates this attack. ### Test plan N/A
1 parent 41730fa commit c003b8e

File tree

5 files changed

+9
-8
lines changed

5 files changed

+9
-8
lines changed

.github/workflows/pull.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,8 @@ jobs:
855855
.ci/scripts/setup-linux.sh --build-tool "cmake"
856856
857857
# Install test requirements
858-
pip install -r backends/nxp/requirements-tests.txt
858+
pip install -r backends/nxp/requirements-tests-pypi.txt
859+
pip install -r backends/nxp/requirements-tests-eiq.txt
859860
860861
# Run pytest
861862
PYTHON_EXECUTABLE=python bash backends/nxp/run_unittests.sh
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
--index-url https://eiq.nxp.com/repository
2+
neutron_converter_SDK_25_03
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
tensorflow==2.18.0
2+
pytest-mock
3+
tflite
4+
GvGen

backends/nxp/requirements-tests.txt

Lines changed: 0 additions & 6 deletions
This file was deleted.

examples/nxp/setup.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@
77
set -u
88

99
# Install neutron-converter
10-
pip install --extra-index-url https://eiq.nxp.com/repository neutron_converter_SDK_25_03
10+
pip install --index-url https://eiq.nxp.com/repository neutron_converter_SDK_25_03

0 commit comments

Comments
 (0)