search

jquast / wcwidth

Python library that measures the width of unicode strings rendered to a terminal
Other
391 stars 58 forks source link

Package hash does not match for latest release 0.2.6 #70

Closed cz-siq closed 1 year ago

cz-siq commented 1 year ago

Hi,

Got below hash error today. Do you have an idea what could have caused it?

Thanks!

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
    wcwidth==0.2.6 from https://files.pythonhosted.org/packages/20/f4/c0584a25144ce20bfcf1aecd041768b8c762c1eb0aa77502a3f0baa83f11/wcwidth-0.2.6-py2.py3-none-any.whl (from -r requirements/develop.txt (line 1712)):
        Expected sha256 a5220780a404dbe3353789870978e472cfe477761f06ee55077256e509b156d0
             Got        795b138f6875577cd91bba52baf9e445cd5118fd32723b460e30a0af30ea230e
jquast commented 1 year ago

I can tell you that I published this today, and from my computer, the "Got" hash is the same as mine.

$ sha256sum dist/wcwidth-0.2.6-py2.py3-none-any.whl
795b138f6875577cd91bba52baf9e445cd5118fd32723b460e30a0af30ea230e  dist/wcwidth-0.2.6-py2.py3-none-any.whl

I'll continue looking into what this might mean.

hugovk commented 1 year ago

The sdist for 0.2.6 was uploaded on 15th January with a SHA256 of a5220780a404dbe3353789870978e472cfe477761f06ee55077256e509b156d0.

The wheel for 0.2.6 was uploaded today with a SHA256 of 795b138f6875577cd91bba52baf9e445cd5118fd32723b460e30a0af30ea230e.

Please update your requirements/develop.txt to match.

Click "view hashes" at https://pypi.org/project/wcwidth/#files to confirm.

jquast commented 1 year ago

Thank you, @hugovk !

dashmug commented 1 year ago

How do we fix this? Installs are failing.

hugovk commented 1 year ago

@dashmug Replace:

a5220780a404dbe3353789870978e472cfe477761f06ee55077256e509b156d0

With:

795b138f6875577cd91bba52baf9e445cd5118fd32723b460e30a0af30ea230e

hartwork commented 1 year ago

@jquast the problem seems to be the delay in upload of the wheel. Any chance you could publish .tar.gz and wheel .zip at the same time in the future? E.g. python3.11 setup.py sdist bdist_wheel would produce both files and then twine can upload both at the same time. That should solve the problem for everyone, since Dependabot picks up all hashes the first time then. Thank you! :pray:

jquast commented 1 year ago

Sorry for the problem, I will try better next release

hartwork commented 1 year ago

@jquast thank you!