Search code examples
pythonpippypi

Check hash of the package during pip install

Is there a way to force pip check if md5 hash of a package matches the one from my requirements file?

So I could have a requirements.txt file like:

drf-compound-fields==0.2.0 md5=999168ac0303c4ea781da9cf47f841c1

Then if a hash is given for a package, pip would verify that hash of *.tar.gz (or whatever format is there) file matches it. If not -- it would refuse to install it.

Otherwise someone could break a developer's system and upload a malicious package version to PyPI.

Solution

  • The peep package adds a hash to your requirement. So if you can check them after installing them the first time, then the hash will take care of checking that the package you expected to download is what pip (peep) is "really" downloading.

    Your requirements.txt file will end up looking something like:

    # sha256: L9XU_-gfdi3So-WEctaQoNu6N2Z3ZQYAOu4-16qor-8
drf-compound-fields==0.2.0

    For more details: https://pypi.python.org/pypi/peep