pip_api: initial support for hashed requirements #126
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
woodruffw
commented
Jan 31, 2022
pip_api/_parse_requirements.py
Outdated
Comment on lines
179
to
183
| class Requirement(requirements.Requirement): | ||
| def __init__(self, *args, **kwargs): | ||
| self.hashes = kwargs.pop("hashes", None) | ||
|
|
||
| super().__init__(*args, **kwargs) |
There was a problem hiding this comment.
N.B.: requirements.Requirement doesn't have any state/API for hashes, so I created a thin child wrapper instead. I figured this would be the least invasive approach, since it doesn't cause any API breakage, but let me know if there's a better/preferred alternative.
woodruffw
commented
Jan 31, 2022
| hashes_by_kind = defaultdict(list) | ||
| if known.hashes: | ||
| for hsh in known.hashes: | ||
| kind, hsh = hsh.split(":", 1) |
There was a problem hiding this comment.
Not sure if it's worth it, but we could also promote any ValueError that happens here (due to a malformed --hash option) into a PipError.
|
cc @tetsuo-cpp |
|
@woodruffw I'm getting ready to release a new version with #127, should we try and include this as well? |
|
Makes sense to me. I can have this ready in a moment. |
woodruffw
commented
Feb 1, 2022
di
reviewed
Feb 1, 2022
di
reviewed
Feb 1, 2022
tetsuo-cpp
approved these changes
Feb 2, 2022
tetsuo-cpp
reviewed
Feb 2, 2022
2 tasks
|
pypa/pip-audit#229 should be good to go once this is in. |
di
reviewed
Feb 3, 2022
Co-authored-by: Dustin Ingram <di@users.noreply.github.com>
di
approved these changes
Feb 3, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WIP.Some things that need to be done:
pip,parse_requirmentsshould go into a "strict" mode as soon as it sees a hashed requirement. In strict mode, any requirements that don't have a hash cause an error.