Verify SHA256 digest of downloaded wheels

pypa / get-pip

Helper scripts to install pip, in a Python installation that doesn't have it.

https://bootstrap.pypa.io/pip/

MIT License

738 stars 293 forks source link

Verify SHA256 digest of downloaded wheels #196

Closed sethmlarson closed 1 year ago

sethmlarson commented 1 year ago

Switches the digest method to be SHA256 instead of MD5.
Verifies the digest of the downloaded wheel is the expected value.

I deleted public/ and re-ran the generation function which resulted in identical get-pip.py scripts so I don't think this was ever an issue, good to have from now on.