In the BaseInstalledDistribution , there is a get_hash function that allows for a custom hasher to be defined. However, the get_hash in BaseInstalledDistribution is only called by InstalledDistribution . The EggInfoDistribution has its own reimplementation of an MD5 function internally, while InstalledDistribution is set to use SHA256. This means the default MD5 function will never be invoked. Should it be removed? Or should the default MD5 algorithm be changed to SHA256, which sounds more secure, even though it will not be called?
def get_hash(self, data, hasher=None):
if hasher is None:
hasher = self.hasher
if hasher is None:
hasher = hashlib.md5
prefix = ''
else:
hasher = getattr(hashlib, hasher)
prefix = '%s=' % self.hasher
digest = hasher(data).digest()
digest = base64.urlsafe_b64encode(digest).rstrip(b'=').decode('ascii')
return '%s%s' % (prefix, digest)