diff --git a/source/guides/hosting-your-own-index.rst b/source/guides/hosting-your-own-index.rst index ebcd228ee..fe981bd2a 100644 --- a/source/guides/hosting-your-own-index.rst +++ b/source/guides/hosting-your-own-index.rst @@ -52,6 +52,29 @@ directory with autoindex enabled. For an example using the built in Web server in `Twisted`_, you would simply run ``twistd -n web --path .`` and then instruct users to add the URL to their installer's configuration. +A bare, automatically generated directory listing, such as one produced by a +generic autoindex module, may not include artifact hashes. Without hashes in +the repository links, tools may be unable to record them in lock files. To +include a SHA-256 hash, generate an ``index.html`` file in each project +directory and append the hash to each artifact URL as described by the +:ref:`Simple Repository API `: + +.. code-block:: html + + + + Links for foo + +

Links for foo

+ Foo-1.0.tar.gz + + + +Replace ``3571b...`` with the full SHA-256 digest of the artifact. You can use +:ref:`dumb-pypi` to generate a static repository with hashes and other Simple +Repository API metadata from a directory of package artifacts. Full repository +implementations should prefer the JSON variant of the Simple Repository API, +which requires a (possibly empty) ``hashes`` mapping for each file. Existing projects ================= @@ -105,11 +128,6 @@ Existing projects - - also mirroring; manual synchronisation - * - :ref:`dumb-pypi` - - - - - - not a server, but a static file site generator - * - :ref:`httpserver` - -