Avoid using --extra-index-url for security

[umangyadav]

Motivation

pip3 install searches for a package both on PyPI and on --extra-index-url if it is provided. If a package with same name exists on both then it picks the package with higher version from both.

Currently on PyPI hip-python package doesn't exist. Therefore someone can publish hip-python package with higher version on PyPI and in that case rocMLIR will fetch that one. This is a security vulnerability. This PR fixes that.

Technical Details

Specifying --index-url will force pip to install package from specific URL only. hip-python package on TestPyPI is owned by AMD. Therefore need to use that specific URL only.

--index-url can not be specific per package basis in requirements.txt file therefore i've moved it directly into Dockerfile.

https://www.websecuritylens.org/how-dependency-confusion-attack-works-and-how-to-prevent-it/

https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

[Copilot]

Pull Request Overview

This PR addresses a dependency confusion security vulnerability by changing how the hip-python package is installed. Instead of using --extra-index-url which searches both PyPI and TestPyPI (potentially allowing a malicious package takeover), it now uses --index-url to exclusively install from AMD's TestPyPI repository.

Key Changes:

• Removed --extra-index-url configuration and hip-python from pip_requirements.txt
• Added explicit pip3 install command with --index-url in the Dockerfile to install hip-python exclusively from TestPyPI

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pip_requirements.txt	Removed TestPyPI index URL and hip-python dependency to prevent dependency confusion attacks
mlir/utils/jenkins/Dockerfile	Added dedicated install command for hip-python using --index-url to restrict package source to TestPyPI only

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.