Skip to content

Document hashes for manually hosted package indexes #2126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
roli-lpci wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Document hashes for manually hosted package indexes #2126

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 20 additions & 5 deletions source/guides/hosting-your-own-index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,26 @@ directory with autoindex enabled. For an example using the built in Web server
in `Twisted`_, you would simply run ``twistd -n web --path .`` and then
instruct users to add the URL to their installer's configuration.

An automatically generated directory listing usually doesn't include artifact
hashes. Without hashes in the repository links, tools may be unable to record
them in lock files. To include a SHA-256 hash, generate an ``index.html`` file
in each project directory and append the hash to each artifact URL as described
by the :ref:`Simple Repository API <simple-repository-html-project-detail>`:

.. code-block:: html

<!DOCTYPE html>
<html lang="en">
<head><title>Links for foo</title></head>
<body>
<h1>Links for foo</h1>
<a href="Foo-1.0.tar.gz#sha256=3571b...">Foo-1.0.tar.gz</a>
</body>
</html>

Replace ``3571b...`` with the full SHA-256 digest of the artifact. You can use
:ref:`dumb-pypi` to generate a static repository with hashes and other Simple
Repository API metadata from a directory of package artifacts.

Existing projects
=================
Expand Down Expand Up @@ -105,11 +125,6 @@ Existing projects
-
- also mirroring; manual synchronisation

* - :ref:`dumb-pypi`
-
-
- not a server, but a static file site generator

* - :ref:`httpserver`
-
-
Expand Down
Loading