Add hash characters to tarball file name and extracted package directory name

[kalefranz]

Append the first 5 characters of the tarball md5 hash to the tarball file name when it's written to the package cache. Also use the same file name (i.e. with the appended md5 characters) as the extracted package directory name.

To clarify, for the tarball file name, the hash should be appended to file name root, before the .tar.bz2 extension. So if the hash characters a1b2c for the file cryptography-1.5.3-py27_0.tar.bz2, the filename written to the cache should be cryptography-1.5.3-py27_0-a1b2c.tar.bz2 and the extracted directory name should be cryptography-1.5.3-py27_0-a1b2c.

I think the - separator is correct here. If it causes a problem with people string parsing file names for information they should be getting from metadata anyway, ¯\_(ツ)_/¯.

[stefanseefeld]

Wouldn't the md5 checksum of a tarball change if its content (including the names of the contained files) change ? Isn't that a catch-22 ?

[stefanseefeld]

(Just verified: it does indeed.)

[stefanseefeld]

This works if the package directory name only gets the hash added after it has been extracted.

[nehaljwani]

I would vote for '#' as a separator :-), like: cryptography-1.5.3-py27_0#a1b2c

[kalefranz]

Interesting suggestion @nehaljwani. @msarahan, @mingwandroid Any thoughts?

[msarahan]

I'd be in favor of # as well. Please do not toss the importance of content after - until we are 90% certain that it's OK - i.e. we've tried it and dogfooded it internally for at least a couple of weeks.

This # notation would not interfere with the conda-build package hashes, so it would be fine. However, I wonder how much this hash filename addition would be necessary once people move to using conda-build 3.

[stefanseefeld]

AFAIU, the only remaining opportunity for collision comes from multiple channels and different subdirs providing the same package (file) names. I'd actually be in favour of reproducing those two axes in our local package cache directory structure. (An added benefit is that it is more transparent to the naked eye.)

[kalefranz]

I think we should hold off on this for now, since it could potentially complicate the problems we're already/still having with metadata hot fixes. Going to close it for now. We can bring it back some point in the future if needed. FWIW, I liked # too.

[github-actions]

Hi there, thank you for your contribution to Conda!

This issue has been automatically locked since it has not had recent activity after it was closed.

Please open a new issue if needed.