Draft PEP: Recording the source hash of installed distribution

[sbidoul (Stéphane Bidoul)]

Would it make sense, for the sake of extensibility, to include these hashes in a json file that provides information about the concrete distribution that the installer used.

In the future, this could be extended with more information such as the URL that was downloaded, the index that provided the distribution, etc.

[NoahGorny]

@sbidoul

Would it make sense, for the sake of extensibility, to include these hashes in a json file that provides information about the concrete distribution that the installer used.

I kind of agree, I think a json format is more extendible and flexible, so I will probably change it in the following days

@encukou

I’m preparing to convert PEP 376 to a proper PyPA specification document . If you end up wanting to change/convert PEP 376, please coordinate with me to avoid conflicts/duplication of work.
Adding a HASH file is out of scope of my effort, but it should be easy to add it to that spec if your PEP is accepted.

I currently do not plan on changing PEP 376, but thanks for your feedback!

@FFY00

The PEP can be used to secure wheels, but the proposed implementation doesn’t do this. To secure wheels, the hash of every wheel file must be present in requirements.txt so that pip can verify the hash of the wheel downloaded. I think I’ve made a bad job of differentiating this two things, sorry.

The idea is to create HASH file in each installation, and then when we look at the environment, we can easily get the hashes. If each time we install we drop a HASH file, every installed distribution will have its hash, and so the hash of every wheel/sdist file will be present in requirements.txt. I hope I explained this in a reasonable way.

@pf_moore

I’d be inclined to say that pip should follow the PEP, not the other way around. If there’s a good reason for pip to have chosen those algorithms, it can be used to justify them for this PEP. If there isn’t, the PEP should recommend something better and pip can change to reflect that.`

Maybe, but this discussion is a big one, and not entirely related only to this PEP draft, I would welcome ideas, but this is not my focus in this PEP