Repository navigation
Private repository dependency isn't exported with sha256 hash #1631
Description
MD5 hashes aren't supported by pip, and SHA256 hashes should be preferred for other reasons as well.
However, it appears that poetry doesn't want to use/calculate the SHA256 hash for a package installed from a private repository.
All my other packages have the right type of hash embedded in the poetry.lock.
{file = "vnxpy-3.10.0-py3-none-any.whl", hash = "sha256:5887fce95ca9ce304f86f7438b6a8d6b80d14895c8f3810fe6eb33b4b01c428c"},
]
warrant = [
{file = "warrant-0.6.1-py2.py3-none-any.whl", hash = "sha256:a4099c566086be45d616ed4f58ed1567893ac74de125e201fc89c9023d8adf7d"},
{file = "warrant-0.6.1.tar.gz", hash = "sha256:749bde7f775c077a64edfe21464654e0a39fc93dd76e27d5d2a61997b6dcaa0a"},
]
wcwidth = [
{file = "wcwidth-0.1.7-py2.py3-none-any.whl", hash = "sha256:f4ebe71925af7b40a864553f761ed559b43544f8f71746c2d756c7fe788ade7c"},
{file = "wcwidth-0.1.7.tar.gz", hash = "sha256:3df37372226d6e63e1b1e1eda15c594bca98a22d33a23832a90998faa96bc65e"},
]
wrapt = [
{file = "wrapt-1.11.2.tar.gz", hash = "sha256:565a021fd19419476b9362b05eeaa094178de64f8361e44468f9e9d7843901e1"},
]
xoipy = [
{file = "xoipy-1.27.1-py3-none-any.whl", hash = "md5:d39b851928a9056177cf8922772ce0b0"},
{file = "xoipy-1.27.1.tar.gz", hash = "md5:238aa209e50aca1f90ada7a126a10327"},
]
Note xoipy, which has md5s specified. The repository itself provides the SHA256 sums, though I have not yet found the code that actually pulls those down, so I can't confirm that poetry is receiving them. If/when I do, I will update this report.
Reacted by adawalli, Aviram Hassan, pauleikis, robpob10, goistjt, Alan Parker Lue, Ani Hatzis, Tom Howard, Chad, Ross Bayer and 6 more
Activity
adawalli commentedon Dec 10, 2019
Did you find any work around @petergaultney ? This is burning my team badly as well....
robpob10 commentedon Feb 10, 2020
I've been blocked by this problem too, and have had a look into it.
In my case, the private repo is hosted on jfrog artifactory, and the problem is ultimately caused by an artifactory bug. To briefly describe this what happens:
curl https://pypi.org/simple/requests/, you'll see data that looks likerequests-2.9.2-py2.py3-none-any.whl#sha256=22a8c72dfc7fc18db1aca6784e97a638e9d09abe2cd387be473f88bd6dcba22f- it has thesha256available in the URL.myproject-4.0.0-py3-none-any.whl#md5=01fd95237bsdhjkshe2cf869- the inbuilt hash is in themd5format (this is the jfrog artifactory bug), so that's what poetry takes.Solutions:
pipenvtackles this problem by streaming the file to compute the SHA256 (see_get_file_hash()andopen_local_or_remote_file()) whenever the SHA256 is unavailable.pipto install the wheels, just download the wheels usingwgetetc instead ofpip, and do the checksum manually.Next actions:
poetrydevs think thatpipenv's compute-it-yourself hash solution is acceptable, I'd like to submit a pull request doing that for cases where the SHA256 is unavailable in the PyPi API output. Please let me know if you think this is a worthwhile approach.adawalli commentedon Feb 10, 2020
I recommend commenting on this https://www.jfrog.com/jira/browse/RTFACT-18495 ARTIFACTORY issue and voting - JFROG hasn't even responded, so it seems like it needs a bit more attention.
thoward27 commentedon May 1, 2020
I think it would be a really nice feature if poetry generated hashes when they weren't present. @robpob10 have you drafted anything up? I'd love to help move this forward
cpvandehey commentedon May 1, 2020
I'd also be interested in helping this move forward as it seems to be a blocker in our suggested workflow with poetry.
repository/legacy: calculate sha256 if unavailable
repository/legacy: calculate sha256 if unavailable
timorkal commentedon Feb 26, 2021
in my case I am using gemfury to store packages.
I am getting the md5 hash in the lock file, but the "poetry export" command refusing to export this type of hash.
Any chance to add this ability?
jmahlik commentedon Mar 3, 2021
Similar issue here. Appears to be related to non pypi repos. Not sure exporting md5 would be useful since pip would refuse to install it with a md5 hash.
jmahlik commentedon Mar 3, 2021
Is seems this could be a good use case for a plugin if it doesn't make its way in to core?
#3733
repository/legacy: calculate sha256 if unavailable
repository/legacy: calculate sha256 if unavailable
repository/legacy: calculate sha256 if unavailable
matejsp commentedon Jun 15, 2022
Just for reference same issue with Nexus: https://issues.sonatype.org/browse/NEXUS-24127
github-actions commentedon Mar 1, 2024
This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.