Document hashes for manually hosted package indexes - #2126
Conversation
merwok
left a comment
merwok
left a comment
There was a problem hiding this comment.
Validation:
- git diff --check
What do you mean by that?
| - | ||
| - not a server, but a static file site generator | ||
|
|
||
| * - :ref:`httpserver` |
There was a problem hiding this comment.
Why is this section removed?
There was a problem hiding this comment.
dumb-pypi was moved rather than dropped: it is now linked in the manual-repository section immediately above, where it is described as the static site generator for this flow. I removed the table row because it is not a server, matching issue #1951’s request.
| An automatically generated directory listing usually doesn't include artifact | ||
| hashes. Without hashes in the repository links, tools may be unable to record | ||
| them in lock files. To include a SHA-256 hash, generate an ``index.html`` file | ||
| in each project directory and append the hash to each artifact URL as described | ||
| by the :ref:`Simple Repository API <simple-repository-html-project-detail>`: |
There was a problem hiding this comment.
I'm not 100% sure what this means: most tools/commercial products that I'm aware of do include artifact hashes. Is there a specific tool/flow you ran into where this isn't the case?
(More generally, I think this particular guide is really stale and no longer reflects received wisdom in the community about how to host your own index. For example, as of PEP 833, we consider the HTML index frozen and encourage people to use the JSON one when possible.)
3 participants
The manual repository example currently recommends serving an automatically
generated directory listing, but those listings usually do not include artifact
hashes. This can leave package-manager lock files without hashes for artifacts
downloaded from the repository.
This adds a hash-bearing project detail page example, links to the Simple
Repository API contract, and points readers to
dumb-pypiwhen they want astatic site generator that supplies hashes and other repository metadata.
Closes #1951.
Validation:
git diff --checknox -s build(strict Sphinx HTML build with missing-reference warnings treated as errors)📚 Documentation preview 📚: https://python-packaging-user-guide--2126.org.readthedocs.build/en/2126/
This contribution was produced by agents through Hermes Labs’ engineering infrastructure. Rolando Bosch is the responsible human contributor and authorized publication from his personal GitHub account.