mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-22 00:31:44 +00:00
a59458053f
Cursor security review flagged that the cron VM downloads the uv release tarball and pipes it straight through `tar -xzO ... > file ; chmod +x`, with no integrity check. A tampered release artifact would execute in a credentialed cron context with access to the docs-repo push token. Download the tarball + the official .sha256 sidecar Astral publishes alongside every uv release to a temp dir, run `sha256sum -c` against the sidecar, and only extract+install on success. On mismatch we wipe the tempdir and `die` with a clear refusal. Co-authored-by: Mateo Wang <mateo-berri@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| _builder_unit_tests | ||
| _driver_unit_tests | ||
| _pr_gate_unit_tests | ||
| basic_messaging_non_streaming | ||
| basic_messaging_streaming | ||
| cron_vm | ||
| extended_thinking | ||
| prompt_caching_5m | ||
| tool_use | ||
| vision | ||
| __init__.py | ||
| cli_driver.py | ||
| conftest.py | ||
| manifest.yaml | ||
| matrix_builder.py | ||
| pr_gate_version_resolver.py | ||
| sample_compatibility-matrix.json | ||
| test_config.yaml | ||