Skip to content

Document hashes for manually hosted package indexes #2126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
roli-lpci wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Document hashes for manually hosted package indexes #2126

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78dccd6
Document hashes for manually hosted package indexes
roli-lpci Sep 6, 2026
fb577c1
Clarify manual index hash guidance
roli-lpci Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 23 additions & 5 deletions source/guides/hosting-your-own-index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,29 @@ directory with autoindex enabled. For an example using the built in Web server
in `Twisted`_, you would simply run ``twistd -n web --path .`` and then
instruct users to add the URL to their installer's configuration.

A bare, automatically generated directory listing, such as one produced by a
generic autoindex module, may not include artifact hashes. Without hashes in
the repository links, tools may be unable to record them in lock files. To
include a SHA-256 hash, generate an ``index.html`` file in each project
directory and append the hash to each artifact URL as described by the
:ref:`Simple Repository API <simple-repository-html-project-detail>`:

.. code-block:: html

<!DOCTYPE html>
<html lang="en">
<head><title>Links for foo</title></head>
<body>
<h1>Links for foo</h1>
<a href="Foo-1.0.tar.gz#sha256=3571b...">Foo-1.0.tar.gz</a>
</body>
</html>

Replace ``3571b...`` with the full SHA-256 digest of the artifact. You can use
:ref:`dumb-pypi` to generate a static repository with hashes and other Simple
Repository API metadata from a directory of package artifacts. Full repository
implementations should prefer the JSON variant of the Simple Repository API,
which requires a (possibly empty) ``hashes`` mapping for each file.

Existing projects
=================
Expand Down Expand Up @@ -105,11 +128,6 @@ Existing projects
-
- also mirroring; manual synchronisation

* - :ref:`dumb-pypi`
-
-
- not a server, but a static file site generator

* - :ref:`httpserver`

@merwok merwok Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this section removed?

@roli-lpci roli-lpci Sep 8, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dumb-pypi was moved rather than dropped: it is now linked in the manual-repository section immediately above, where it is described as the static site generator for this flow. I removed the table row because it is not a server, matching issue #1951’s request.

-
-
Expand Down