Repository navigation
Document hashes for manually hosted package indexes - #2126
roli-lpci wants to merge 3 commits into
Conversation
Sorry, something went wrong.
merwok
left a comment
There was a problem hiding this comment.
Validation:
- git diff --check
What do you mean by that?
Sorry, something went wrong.
| - | ||
| - not a server, but a static file site generator | ||
|
|
||
| * - :ref:`httpserver` |
There was a problem hiding this comment.
Why is this section removed?
Sorry, something went wrong.
There was a problem hiding this comment.
dumb-pypi was moved rather than dropped: it is now linked in the manual-repository section immediately above, where it is described as the static site generator for this flow. I removed the table row because it is not a server, matching issue #1951’s request.
Sorry, something went wrong.
| An automatically generated directory listing usually doesn't include artifact | ||
| hashes. Without hashes in the repository links, tools may be unable to record | ||
| them in lock files. To include a SHA-256 hash, generate an ``index.html`` file | ||
| in each project directory and append the hash to each artifact URL as described | ||
| by the :ref:`Simple Repository API <simple-repository-html-project-detail>`: |
There was a problem hiding this comment.
I'm not 100% sure what this means: most tools/commercial products that I'm aware of do include artifact hashes. Is there a specific tool/flow you ran into where this isn't the case?
(More generally, I think this particular guide is really stale and no longer reflects received wisdom in the community about how to host your own index. For example, as of PEP 833, we consider the HTML index frozen and encourage people to use the JSON one when possible.)
Sorry, something went wrong.
|
No follow up to review questions and this looks like a fully AI-driven PR; I plan to close it soon unless there's proper engagement. |
Sorry, something went wrong.
The manual repository example currently recommends serving an automatically
generated directory listing, but those listings usually do not include artifact
hashes. This can leave package-manager lock files without hashes for artifacts
downloaded from the repository.
This adds a hash-bearing project detail page example, links to the Simple
Repository API contract, and points readers to dumb-pypi when they want a
static site generator that supplies hashes and other repository metadata.
Closes #1951.
Validation:
📚 Documentation preview 📚: https://python-packaging-user-guide--2126.org.readthedocs.build/en/2126/
This contribution was produced by agents through Hermes Labs’ engineering infrastructure. Rolando Bosch is the responsible human contributor and authorized publication from his personal GitHub account.