package verification

[Ioakim Ioakim]

Hi

Does anyone know where in the source code a package gets verified before being installed?

Thanks

[Sviatoslav Sydorenko]

Are you talking about `--require-hashes` in Pip?

чт, 25 лип. 2019 о 19:30 Ioakim Ioakim <ioak...@gmail.com> пише:

Hi

Does anyone know where in the source code a package gets verified before being installed?

Thanks

--
You received this message because you are subscribed to the Google Groups "pypa-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pypa-dev+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pypa-dev/89e6ae88-8fb6-40eb-b1a5-d04b94f32710%40googlegroups.com.

--

Kind regards,

Sviatoslav Sydorenko

email: nospam.s...@sydorenko.org.ua

cell #: +380978963757

[Ioakim Ioakim]

I am not sure. I am just looking to find where in the source code a package gets verified before being installed on a client's machine

[Brett Cannon]

Sviatoslav

On Fri, Jul 26, 2019 at 4:58 AM Ioakim Ioakim <ioak...@gmail.com> wrote:

I am not sure. I am just looking to find where in the source code a package gets verified before being installed on a client's machine

Unfortunately something stripped out what you were replying to,  Ioakim, but I assume it was to Sviatoslav and his --require-hashes suggestion, in which case that's what you're looking for if you want to verify what you downloaded matches what PyPI has.

[Ian Stapleton Cordasco]

To be clear, there is no verification or scanning of source code. Not is there verification of origin. PyPI generates hashes that are used to verify the integrity of what was uploaded there and then downloaded

Sent from my phone with my typo-happy thumbs. Please excuse my brevity

--

You received this message because you are subscribed to the Google Groups "pypa-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pypa-dev+u...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/pypa-dev/CAP1%3D2W5YzPxkFaUeoe0%3Dsq%3DFi43HqRMWo0tay6LYYA8cUKXW9A%40mail.gmail.com.

[Ioakim Ioakim]

Thanks guys

On Saturday, 27 July 2019 00:29:45 UTC+1, Ian Stapleton Cordasco wrote:

To be clear, there is no verification or scanning of source code. Not is there verification of origin. PyPI generates hashes that are used to verify the integrity of what was uploaded there and then downloaded

Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Fri, Jul 26, 2019, 11:41 Brett Cannon <br...@python.org> wrote:

Sviatoslav

On Fri, Jul 26, 2019 at 4:58 AM Ioakim Ioakim <ioak...@gmail.com> wrote:

I am not sure. I am just looking to find where in the source code a package gets verified before being installed on a client's machine

Unfortunately something stripped out what you were replying to,  Ioakim, but I assume it was to Sviatoslav and his --require-hashes suggestion, in which case that's what you're looking for if you want to verify what you downloaded matches what PyPI has.

--
You received this message because you are subscribed to the Google Groups "pypa-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to pypa...@googlegroups.com.

[Chris Jerdonek]

On Fri, Jul 26, 2019 at 4:57 AM Ioakim Ioakim <ioak...@gmail.com> wrote:

I am not sure. I am just looking to find where in the source code a package gets verified before being installed on a client's machine

If you're using pip with e.g. --require-hashes, it looks like these (after a quick search) are the two main places in pip's code where pip checks the hashes of downloaded files:

* in _download_url(): https://github.com/pypa/pip/blob/2e51624bbb42c83ac3ec5898f71657ea5186a784/src/pip/_internal/download.py#L858-L859
* in unpack_file_url(): https://github.com/pypa/pip/blob/2e51624bbb42c83ac3ec5898f71657ea5186a784/src/pip/_internal/download.py#L959-L965

--Chris

[Ioakim Ioakim]

thanks