packaging.pypi should not require checksums

[jimfulton]

BPO	14280
Nosy	@tarekziade, @merwok, @jimfulton

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2014-03-13.02:28:02.280>
created_at = <Date 2012-03-13.00:40:34.607>
labels = []
title = 'packaging.pypi should not require checksums'
updated_at = <Date 2014-03-13.02:28:02.280>
user = 'https://github.com/jimfulton'

bugs.python.org fields:

activity = <Date 2014-03-13.02:28:02.280>
actor = 'eric.araujo'
assignee = 'alexis'
closed = True
closed_date = <Date 2014-03-13.02:28:02.280>
closer = 'eric.araujo'
components = ['Distutils2']
creation = <Date 2012-03-13.00:40:34.607>
creator = 'j1m'
dependencies = []
files = []
hgrepos = []
issue_num = 14280
keywords = []
message_count = 5.0
messages = ['155542', '155544', '155906', '155925', '155959']
nosy_count = 4.0
nosy_names = ['tarek', 'eric.araujo', 'j1m', 'alexis']
pr_nums = []
priority = 'normal'
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue14280'
versions = ['3rd party', 'Python 3.3']

[jimfulton]

Requiring md5s makes it hard to implement simple indexes with simple web servers, where simple indexes include flat directories of distributions.

[merwok]

I’m not sure that this report should not be merged with bpo-14279, but Alexis will judge that.

[alexis]

If no MD5 checksum is present on the crawled simple index, then we don't have to check them. This means we introduce a potential security hole here (md5 checksums were added for a reason).

What could be done is to explicitely don't check them if asked so. For instance using a --no-checksum flag when running pysetup, or passing a no_checksum argument when using the crawler.

Would that work for you?

Éric, this is a different issue than the one you pointed out in the sence that one is for local files and the other is for remote indexes. (Of course, local files, will not need checksums as well).

[jimfulton]

I just clarified that 14279 doesn't imply local files.

I'd be fine with a warning about lack of checksums for downloads.

[alexis]

Right, I'll go for this then.