android: hash-pin hostpython prerequisites for pyqt6sip and sip
What the developer wrote
Authored by Sander van Grieken
android: hash-pin hostpython prerequisites for pyqt6sip and sip
What changed, and why it matters
This commit strengthens the security of Electrum's Android build process by adding cryptographic hash checks for two helper Python packages (setuptools and packaging) used when compiling parts of the app. Before this change, those helper packages could have been downloaded without verification, potentially allowing a compromised or malicious package to tamper with the Android build. The change is a hardening improvement, not a fix for a known active attack.
No immediate user action is required. Developers building Electrum for Android should ensure they are using a version of python-for-android that supports `HashPinnedDependency` and that the pinned hashes match the intended upstream package releases. Consider auditing other unpinned hostpython prerequisites in the Android build recipes.
Security signals we found
Adds hash pinning for build-time host Python dependencies
Targets PyQt6Sip and Sip Android build recipes
Pins setuptools==80.9.0 and packaging==26.0 with SHA-256 hashes
Hardens supply-chain integrity of the Android build pipeline
Evidence from the diff
The commit adds hostpython_prerequisites lists to two Python-for-Android recipe overrides (pyqt6sip and sip) in contrib/android/p4a_recipes/. Each list contains HashPinnedDependency entries that pin specific versions of setuptools and packaging and include SHA-256 hashes. This ensures the build system verifies the exact contents of these host-side Python packages before use, reducing the risk of supply-chain compromise during Android builds.
Changed components
contrib/android/p4a_recipes/pyqt6sip/__init__.pycontrib/android/p4a_recipes/sip/__init__.pyAndroid build pipeline host Python prerequisitesInspect captured patch +14 / −2
diff --git a/contrib/android/p4a_recipes/pyqt6sip/__init__.py b/contrib/android/p4a_recipes/pyqt6sip/__init__.py
index 9aa70d6..dea2237 100644
--- a/contrib/android/p4a_recipes/pyqt6sip/__init__.py
+++ b/contrib/android/p4a_recipes/pyqt6sip/__init__.py
@@ -1,7 +1,7 @@
import os
from pythonforandroid.recipes.pyqt6sip import PyQt6SipRecipe
-from pythonforandroid.util import load_source
+from pythonforandroid.util import load_source, HashPinnedDependency
util = load_source('util', os.path.join(os.path.dirname(os.path.dirname(__file__)), 'util.py'))
@@ -14,5 +14,12 @@ assert PyQt6SipRecipe.python_depends == []
class PyQt6SipRecipePinned(util.InheritedRecipeMixin, PyQt6SipRecipe):
sha512sum = "555b061eec3db6a66388fae07de21f58d756f6f12b13e4ede729c3348d2c8997ac5a59d3006ee45c3a09b5cde673f579265fa254bc583a4ba721748cf8f3a617"
+ hostpython_prerequisites = [
+ HashPinnedDependency(package="setuptools==80.9.0",
+ hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+ HashPinnedDependency(package="packaging==26.0",
+ hashes=['sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529']),
+ ]
+
recipe = PyQt6SipRecipePinned()
diff --git a/contrib/android/p4a_recipes/sip/__init__.py b/contrib/android/p4a_recipes/sip/__init__.py
index c603c51..af6fdff 100644
--- a/contrib/android/p4a_recipes/sip/__init__.py
+++ b/contrib/android/p4a_recipes/sip/__init__.py
@@ -1,5 +1,5 @@
from pythonforandroid.recipes.sip import SipRecipe
-
+from pythonforandroid.util import HashPinnedDependency
assert SipRecipe._version == "6.15.1"
assert SipRecipe.depends == ["python3"], SipRecipe.depends
@@ -9,5 +9,10 @@ assert SipRecipe.python_depends == []
class SipRecipePinned(SipRecipe):
sha512sum = "30a312419ba82c0221c0cf03c3fb3ad7d45bb8fe633d1d7477025a7986b0a7f7b7b781a8d9cd6bcdb78f3b872231fd1eed123a761b497861822f2e35093f574d"
+ hostpython_prerequisites = [
+ HashPinnedDependency(package="setuptools==80.9.0",
+ hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+ ]
+
recipe = SipRecipePinned()
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.