Open k9ert opened 3 years ago
AFAIK, we could proceed as follows:
Calculate sha256sum for both source and wheel release during the release_pip
CI step.
WHEEL_HASH=$(sha256sum cryptoadvance.specter-*.whl)
SRC_HASH=$(sha256sum cryptoadvance.specter-*.tar.gz)
echo "$WHEEL_HASH" > SHA256SUMS-pip
echo "$SRC_HASH" >> SHA256SUMS-pip
Create an additional requirement file (pipy-requires.txt) for cryptoadvance.specter
pinning its hashes during the release_pip
CI step
echo "-r requirements.txt" > pipy-requires.txt
echo "cryptoadvance.specter==${CI_COMMIT_TAG} \\" >> pipy-requires.txt
echo " --hash=sha256:${WHEEL_HASH%% *} \\" >> pipy-requires.txt
echo " --hash=sha256:${SRC_HASH%% *}" >> pipy-requires.txt
Distribute pipy-requires.txt through github releases or any other means
User can then download pipy-requires.txt and simply execute pip install -r pipy-requires.txt
to do a proper hash-verfied pip-installtion out of packages as well.
If this makes sense to you, I can update CI script to work accordingly.
The pip-installation was the first installation we had and #496 did a great job with this for the Development setup. But is it possible to do a proper hash-verfied pip-installtion out of packages as well?
Currently that doesn't seem to be the case. Or at least, it's quite cumbersome:
It's not clear to me where to pin that version. Maybe it should be pinned in the requirements.txt BEFORE release? Should test that. However, if we would do that, How can you be sure that the hash which you get from the pip-package-management-system is the correct hash? Because of that, i though the right way would do a release of a tar.gz-ninary and a manual hashing:
So this unfortunately doesn't work either. Any hints highly appreciated.