From deadee920e721685bc6e9d7c9401124be621297f Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Thu, 1 Sep 2016 10:51:50 +0200
Subject: [PATCH 1/7] Ensure local pypy is preferred over distribution python

* docker-library/python#137
---
 2/Dockerfile      | 4 ++--
 2/slim/Dockerfile | 4 ++--
 3/Dockerfile      | 4 ++--
 3/slim/Dockerfile | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/2/Dockerfile b/2/Dockerfile
index 5aab20f..0f26890 100644
--- a/2/Dockerfile
+++ b/2/Dockerfile
@@ -1,7 +1,7 @@
 FROM buildpack-deps:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
diff --git a/2/slim/Dockerfile b/2/slim/Dockerfile
index cd4dc20..901f963 100644
--- a/2/slim/Dockerfile
+++ b/2/slim/Dockerfile
@@ -1,7 +1,7 @@
 FROM debian:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
diff --git a/3/Dockerfile b/3/Dockerfile
index fd5c4ed..68e17bc 100644
--- a/3/Dockerfile
+++ b/3/Dockerfile
@@ -1,7 +1,7 @@
 FROM buildpack-deps:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
diff --git a/3/slim/Dockerfile b/3/slim/Dockerfile
index 0cd4156..b4b984c 100644
--- a/3/slim/Dockerfile
+++ b/3/slim/Dockerfile
@@ -1,7 +1,7 @@
 FROM debian:jessie
 
-# remove several traces of debian python
-RUN apt-get purge -y python.*
+# ensure local pypy is preferred over distribution python
+ENV PATH /usr/local/bin:$PATH
 
 # http://bugs.python.org/issue19846
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.

From 0af29acce89c2ad6dad42a8a264093807bb417f1 Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Thu, 1 Sep 2016 11:50:55 +0200
Subject: [PATCH 2/7] Install pip like we do for the python images

* docker-library/python#121
* Some of docker-library/python#139
* docker-library/python#144
---
 2/Dockerfile      | 23 +++++++++++++++++------
 2/slim/Dockerfile | 18 +++++++++++++++---
 3/Dockerfile      | 26 ++++++++++++++++++++------
 3/slim/Dockerfile | 23 +++++++++++++++++++----
 4 files changed, 71 insertions(+), 19 deletions(-)

diff --git a/2/Dockerfile b/2/Dockerfile
index 0f26890..4bd1db7 100644
--- a/2/Dockerfile
+++ b/2/Dockerfile
@@ -9,13 +9,24 @@ ENV LANG C.UTF-8
 
 ENV PYPY_VERSION 5.4.0
 
-RUN set -x \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1
-
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
-RUN curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION
+
+RUN set -x \
+	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+		| tar -xjC /usr/local --strip-components=1 \
+	\
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& rm -rf ~/.cache
 
 CMD ["pypy"]
diff --git a/2/slim/Dockerfile b/2/slim/Dockerfile
index 901f963..bf958dd 100644
--- a/2/slim/Dockerfile
+++ b/2/slim/Dockerfile
@@ -14,6 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.4.0
+
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
@@ -21,8 +22,19 @@ RUN set -x \
 	&& apt-get update && apt-get install -y bzip2 curl --no-install-recommends && rm -rf /var/lib/apt/lists/* \
 	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
 		| tar -xjC /usr/local --strip-components=1 \
-	&& curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION \
-	&& apt-get purge -y --auto-remove bzip2 curl
+	\
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& apt-get purge -y --auto-remove bzip2 curl \
+	&& rm -rf ~/.cache
 
 CMD ["pypy"]
diff --git a/3/Dockerfile b/3/Dockerfile
index 68e17bc..1d3b161 100644
--- a/3/Dockerfile
+++ b/3/Dockerfile
@@ -9,13 +9,27 @@ ENV LANG C.UTF-8
 
 ENV PYPY_VERSION 5.2.0-alpha1
 
-RUN set -x \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1
-
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
-RUN curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy3 \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION
+
+RUN set -x \
+	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+		| tar -xjC /usr/local --strip-components=1 \
+	\
+# explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
+	&& if [ ! -e /usr/local/bin/pip3 ]; then : \
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy3 /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+	; fi \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip3 install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& rm -rf ~/.cache
 
 CMD ["pypy3"]
diff --git a/3/slim/Dockerfile b/3/slim/Dockerfile
index b4b984c..62f48a0 100644
--- a/3/slim/Dockerfile
+++ b/3/slim/Dockerfile
@@ -14,15 +14,30 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.2.0-alpha1
+
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
 RUN set -x \
-	&& apt-get update && apt-get install -y bzip2 curl --no-install-recommends && rm -rf /var/lib/apt/lists/* \
+	&& apt-get update && apt-get install -y bzip2 curl wget --no-install-recommends && rm -rf /var/lib/apt/lists/* \
 	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
 		| tar -xjC /usr/local --strip-components=1 \
-	&& curl -SL 'https://bootstrap.pypa.io/get-pip.py' | pypy3 \
-	&& pip install --upgrade pip==$PYTHON_PIP_VERSION \
-	&& apt-get purge -y --auto-remove bzip2 curl
+	\
+# explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
+	&& if [ ! -e /usr/local/bin/pip3 ]; then : \
+		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
+		&& pypy3 /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
+		&& rm /tmp/get-pip.py \
+	; fi \
+# we use "--force-reinstall" for the case where the version of pip we're trying to install is the same as the version bundled with Python
+# ("Requirement already up-to-date: pip==8.1.2 in /usr/local/lib/python3.6/site-packages")
+# https://github.com/docker-library/python/pull/143#issuecomment-241032683
+	&& pip3 install --no-cache-dir --upgrade --force-reinstall "pip==$PYTHON_PIP_VERSION" \
+# then we use "pip list" to ensure we don't have more than one pip version installed
+# https://github.com/docker-library/python/pull/100
+	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
+	\
+	&& apt-get purge -y --auto-remove bzip2 curl wget \
+	&& rm -rf ~/.cache
 
 CMD ["pypy3"]

From 88d10f0933ffb87f1d2de9c5c89fc704ba439709 Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Thu, 1 Sep 2016 12:09:00 +0200
Subject: [PATCH 3/7] Fetch PyPy using wget and install fetch deps using
 variable

* Most of the rest of docker-library/python#139
---
 2/Dockerfile      |  4 ++--
 2/slim/Dockerfile | 13 +++++++++----
 3/Dockerfile      |  4 ++--
 3/slim/Dockerfile | 13 +++++++++----
 4 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/2/Dockerfile b/2/Dockerfile
index 4bd1db7..fe12802 100644
--- a/2/Dockerfile
+++ b/2/Dockerfile
@@ -12,8 +12,8 @@ ENV PYPY_VERSION 5.4.0
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
-RUN set -x \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+RUN set -ex \
+	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
 		| tar -xjC /usr/local --strip-components=1 \
 	\
 		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
diff --git a/2/slim/Dockerfile b/2/slim/Dockerfile
index bf958dd..9a0499c 100644
--- a/2/slim/Dockerfile
+++ b/2/slim/Dockerfile
@@ -18,9 +18,14 @@ ENV PYPY_VERSION 5.4.0
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
-RUN set -x \
-	&& apt-get update && apt-get install -y bzip2 curl --no-install-recommends && rm -rf /var/lib/apt/lists/* \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+RUN set -ex \
+	&& fetchDeps=' \
+		bzip2 \
+		wget \
+	' \
+	&& apt-get update && apt-get install -y $fetchDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
+	\
+	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
 		| tar -xjC /usr/local --strip-components=1 \
 	\
 		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
@@ -34,7 +39,7 @@ RUN set -x \
 # https://github.com/docker-library/python/pull/100
 	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
 	\
-	&& apt-get purge -y --auto-remove bzip2 curl \
+	&& apt-get purge -y --auto-remove $fetchDeps \
 	&& rm -rf ~/.cache
 
 CMD ["pypy"]
diff --git a/3/Dockerfile b/3/Dockerfile
index 1d3b161..3e2a306 100644
--- a/3/Dockerfile
+++ b/3/Dockerfile
@@ -12,8 +12,8 @@ ENV PYPY_VERSION 5.2.0-alpha1
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
-RUN set -x \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+RUN set -ex \
+	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
 		| tar -xjC /usr/local --strip-components=1 \
 	\
 # explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
diff --git a/3/slim/Dockerfile b/3/slim/Dockerfile
index 62f48a0..be88e6e 100644
--- a/3/slim/Dockerfile
+++ b/3/slim/Dockerfile
@@ -18,9 +18,14 @@ ENV PYPY_VERSION 5.2.0-alpha1
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
-RUN set -x \
-	&& apt-get update && apt-get install -y bzip2 curl wget --no-install-recommends && rm -rf /var/lib/apt/lists/* \
-	&& curl -SL "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+RUN set -ex \
+	&& fetchDeps=' \
+		bzip2 \
+		wget \
+	' \
+	&& apt-get update && apt-get install -y $fetchDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
+	\
+	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
 		| tar -xjC /usr/local --strip-components=1 \
 	\
 # explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
@@ -37,7 +42,7 @@ RUN set -x \
 # https://github.com/docker-library/python/pull/100
 	&& [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ] \
 	\
-	&& apt-get purge -y --auto-remove bzip2 curl wget \
+	&& apt-get purge -y --auto-remove $fetchDeps \
 	&& rm -rf ~/.cache
 
 CMD ["pypy3"]

From f61a4970ffa7415d2a143cc28a925d80f11e49f9 Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Thu, 1 Sep 2016 12:23:57 +0200
Subject: [PATCH 4/7] Install libffi in the slim images

* Seems to have gotten lost somewhere along the way
---
 2/slim/Dockerfile | 1 +
 3/slim/Dockerfile | 1 +
 2 files changed, 2 insertions(+)

diff --git a/2/slim/Dockerfile b/2/slim/Dockerfile
index 9a0499c..32f5a48 100644
--- a/2/slim/Dockerfile
+++ b/2/slim/Dockerfile
@@ -10,6 +10,7 @@ ENV LANG C.UTF-8
 RUN apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
 		libexpat1 \
+		libffi6 \
 		libsqlite3-0 \
 	&& rm -rf /var/lib/apt/lists/*
 
diff --git a/3/slim/Dockerfile b/3/slim/Dockerfile
index be88e6e..1eccf72 100644
--- a/3/slim/Dockerfile
+++ b/3/slim/Dockerfile
@@ -10,6 +10,7 @@ ENV LANG C.UTF-8
 RUN apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
 		libexpat1 \
+		libffi6 \
 		libsqlite3-0 \
 	&& rm -rf /var/lib/apt/lists/*
 

From fbfab37a60454c4478ac616c7e333e2be7577b6f Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Thu, 1 Sep 2016 12:32:48 +0200
Subject: [PATCH 5/7] Add tcl and tk as runtime dependencies to non-slim images
 for tkinter

...support

* docker-library/python#127
---
 2/Dockerfile | 6 ++++++
 3/Dockerfile | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/2/Dockerfile b/2/Dockerfile
index fe12802..16d5d9f 100644
--- a/2/Dockerfile
+++ b/2/Dockerfile
@@ -7,6 +7,12 @@ ENV PATH /usr/local/bin:$PATH
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
 ENV LANG C.UTF-8
 
+# runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+		tcl \
+		tk \
+	&& rm -rf /var/lib/apt/lists/*
+
 ENV PYPY_VERSION 5.4.0
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
diff --git a/3/Dockerfile b/3/Dockerfile
index 3e2a306..4b63d4f 100644
--- a/3/Dockerfile
+++ b/3/Dockerfile
@@ -7,6 +7,12 @@ ENV PATH /usr/local/bin:$PATH
 # > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
 ENV LANG C.UTF-8
 
+# runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+		tcl \
+		tk \
+	&& rm -rf /var/lib/apt/lists/*
+
 ENV PYPY_VERSION 5.2.0-alpha1
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"

From 72cec48996d57b0e30b0bf1447c89847a0dbd368 Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Thu, 1 Sep 2016 12:54:50 +0200
Subject: [PATCH 6/7] Check the PyPy download's SHA256SUM

---
 2/Dockerfile      | 7 +++++--
 2/slim/Dockerfile | 7 +++++--
 3/Dockerfile      | 7 +++++--
 3/slim/Dockerfile | 7 +++++--
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/2/Dockerfile b/2/Dockerfile
index 16d5d9f..60d78a5 100644
--- a/2/Dockerfile
+++ b/2/Dockerfile
@@ -14,13 +14,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.4.0
+ENV PYPY_SHA256SUM bdfea513d59dcd580970cb6f79f3a250d00191fd46b68133d5327e924ca845f8
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
 RUN set -ex \
-	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1 \
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
 	\
 		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
 		&& pypy /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
diff --git a/2/slim/Dockerfile b/2/slim/Dockerfile
index 32f5a48..b635229 100644
--- a/2/slim/Dockerfile
+++ b/2/slim/Dockerfile
@@ -15,6 +15,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.4.0
+ENV PYPY_SHA256SUM bdfea513d59dcd580970cb6f79f3a250d00191fd46b68133d5327e924ca845f8
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
@@ -26,8 +27,10 @@ RUN set -ex \
 	' \
 	&& apt-get update && apt-get install -y $fetchDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
 	\
-	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1 \
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy2-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
 	\
 		&& wget -O /tmp/get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
 		&& pypy /tmp/get-pip.py "pip==$PYTHON_PIP_VERSION" \
diff --git a/3/Dockerfile b/3/Dockerfile
index 4b63d4f..969518d 100644
--- a/3/Dockerfile
+++ b/3/Dockerfile
@@ -14,13 +14,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.2.0-alpha1
+ENV PYPY_SHA256SUM f5e66ab24267d6ddf662d07c512d06c10ebc732ae62093dabbd775ac63b9060a
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
 
 RUN set -ex \
-	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1 \
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
 	\
 # explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
 	&& if [ ! -e /usr/local/bin/pip3 ]; then : \
diff --git a/3/slim/Dockerfile b/3/slim/Dockerfile
index 1eccf72..f9c8d5a 100644
--- a/3/slim/Dockerfile
+++ b/3/slim/Dockerfile
@@ -15,6 +15,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 ENV PYPY_VERSION 5.2.0-alpha1
+ENV PYPY_SHA256SUM f5e66ab24267d6ddf662d07c512d06c10ebc732ae62093dabbd775ac63b9060a
 
 # if this is called "PIP_VERSION", pip explodes with "ValueError: invalid truth value '<VERSION>'"
 ENV PYTHON_PIP_VERSION 8.1.2
@@ -26,8 +27,10 @@ RUN set -ex \
 	' \
 	&& apt-get update && apt-get install -y $fetchDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
 	\
-	&& wget -O- "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
-		| tar -xjC /usr/local --strip-components=1 \
+	&& wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/pypy3.3-v${PYPY_VERSION}-linux64.tar.bz2" \
+	&& echo "$PYPY_SHA256SUM  pypy.tar.bz2" | sha256sum -c \
+	&& tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2 \
+	&& rm pypy.tar.bz2 \
 	\
 # explicit path to "pip3" to ensure distribution-provided "pip3" cannot interfere
 	&& if [ ! -e /usr/local/bin/pip3 ]; then : \

From 9a3996374a56828c454c6e076dda5c5fb66957fc Mon Sep 17 00:00:00 2001
From: Jamie Hewland <jhewland@gmail.com>
Date: Mon, 5 Sep 2016 09:38:35 +0200
Subject: [PATCH 7/7] Add command to fetch SHA256 checksum to update.sh

---
 update.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/update.sh b/update.sh
index e2df8af..60eefa2 100755
--- a/update.sh
+++ b/update.sh
@@ -21,10 +21,19 @@ for version in "${versions[@]}"; do
 	# <td class="name"><a class="execute" href="/pypy/pypy/downloads/pypy3-2.4.0-linux64.tar.bz2">pypy3-2.4.0-linux64.tar.bz2</a></td>
 	fullVersion="$(curl -sSL 'https://bitbucket.org/pypy/pypy/downloads' | grep -E "$pypy"'-v([0-9.]+(-alpha[0-9]*)?)-linux64.tar.bz2' | sed -r 's/^.*'"$pypy"'-v([0-9.]+(-alpha[0-9]*)?)-linux64.tar.bz2.*$/\1/' | sort -V | tail -1)"
 
+	# <p>pypy2.7-5.4.0 sha256:</p>
+	# <pre class="literal-block">
+	# ...
+	# bdfea513d59dcd580970cb6f79f3a250d00191fd46b68133d5327e924ca845f8  pypy2-v5.4.0-linux64.tar.bz2
+	# ...
+	# </pre>
+	sha256sum="$(curl -sSL 'http://pypy.org/download.html' | grep -m1 -E '[a-f0-9]{64}  '"$pypy-v$fullVersion"'-linux64.tar.bz2' | cut -d' ' -f1)"
+
 	(
 		set -x
 		sed -ri '
 			s/^(ENV PYPY_VERSION) .*/\1 '"$fullVersion"'/;
+			s/^(ENV PYPY_SHA256SUM) .*/\1 '"$sha256sum"'/;
 			s/^(ENV PYTHON_PIP_VERSION) .*/\1 '"$pipVersion"'/;
 		' "$version"{,/slim}/Dockerfile
 		sed -ri 's/^(FROM pypy):.*/\1:'"$version"'/' "$version/onbuild/Dockerfile"