Package: hashin-pyup
Helps you write yourrequirements.txtwith hashes so you can
install withpip install--require-hashes-r...If you want to add a package or edit the version of one you’re currently
using you have to do the following steps:Go to pypi for that packageDownload the.tgzfilePossibly download the.whlfileRunpip hashdownloadedpackage-1.2.3.tgzRunpip hashdownloadedpackage-1.2.3.whlEditrequirements.txtThis script does all those things.
Hackishly wonderfully so.A Word of Warning!The whole point of hashing is that youvet the packagesthat you use
on your laptop and that they haven’t been tampered with. Then you
can confidently install them on a server.This tool downloads from PyPI (over HTTPS) and runspip hashon the downloaded files.You should check that the packages that are downloaded
are sane and not tampered with. The way you do that is to runhashinas normal but with the--verboseflag. When you do that
it will print where it downloaded the relevant files and those
files are not deleted. For example:$ hashin --verbose bgg /tmp/reqs.txt
https://pypi.python.org/pypi/bgg/json
* Latest version for 0.22.1
* Found URL https://pypi.python.org/packages/2.7/b/bgg/bgg-0.22.1-py2-none-any.whl
*   Re-using /var/folders/1x/2hf5hbs902q54g3bgby5bzt40000gn/T/bgg-0.22.1-py2-none-any.whl
*   Hash e5172c3fda0e8a42d1797fd1ff75245c3953d7c8574089a41a219204dbaad83d
* Found URL https://pypi.python.org/packages/source/b/bgg/bgg-0.22.1.tar.gz
*   Re-using /var/folders/1x/2hf5hbs902q54g3bgby5bzt40000gn/T/bgg-0.22.1.tar.gz
*   Hash aaa53aea1cecb8a6e1288d6bfe52a51408a264a97d5c865c38b34ae16c9bff88
* Editing /tmp/reqs.txtYou might not have time to go through the lines one by one
but you should be aware that the vetting process is your
responsibility.InstallationThis is something you only do or ever need in a development
environment. Ie. your laptop:pip install hashinHow to use itSuppose you want to installfutures. You can either do this:hashin futuresWhich will download the latest version tarball (and wheel) and
calculate their pip hash and edit yourrequirements.txtfile.Or you can be specific about exactly which version you want:hashin "futures==2.1.3"You can also specify more than one package at a time:hashin "futures==2.1.3" requestsSuppose you don’t have arequirements.txtright there in the same
directory you can specify--requirements-file:hashin futures --requirements-file=stuff/requirements/prod.txtBy defaultsha256hashes are used, but this can be overridden using the--algorithmargument:hashin futures --algorithm=sha512If there’s no output, it worked. Check how it edited your
requirements file.Filtering releases by Python versionSome requirements have many releases built for different versions of Python and
different architectures. These hashes aren’t useful in some cases, if those
wheels don’t work with your project.hashincan filter on the Python
version to skip these extraneous hashes.For example, thecffipackage offers wheels built for many versions of
CPython from 2.6 to 3.5. To select only one of them, you can use the--python-versionoption:hashin "cffi==1.5.2" --python-version 3.5If you need to support multiple versions, you can pass this option multiple
times:hashin "cffi==1.5.2" --python-version 2.7 --python-version 3.5hashinwill expand these Python versions to a full list of identifers that
could be found on PyPI. For example,3.5will expand to match any of3.5,py3,py3.5,py2.py3, orcp3.5. You can also specify
these exact identifiers directly, if you need something specific.Thesourcerelease is always automatically included.pipwill use
this as a fallback in the case a suitable wheel cannot be found.Running testsSimply run:python setup.py testDebuggingTo avoid having to installhashinjust to test it or debug a feature
you can simply just run it like this:touch /tmp/whatever.txt
python hashin.py --verbose Django /tmp/whatever.txtHistoryThis program is a “fork” ofhttps://pypi.python.org/pypi/peepinpeepinwas a companion to the programpeephttps://pypi.python.org/pypi/peep/but the functionality ofpeephas been put directly intopipas of version 8.FutureIf this script proves itself to work and be useful, I hope we can
put it directly intopip.Version History0.7.1Package matching is now case insensitive. E.g.hashin dJaNgO0.7.0The requirements file and algorithm arguments are now keyword
arguments. Now, the second, third, nth positional argument are
additional arguments. Thanks @https://github.com/ahal0.6.1Support windows binaries packaged as a.msifile.0.6.0Fix compatibility issue with pip 8.1.2 and 8.1.1-2ubuntu0.1 and drop
support for Python 2.60.5.0Important bug fix. As an example, if you hadpytest-selenium==...already in yourrequirements.txtfile and addselenium==x.y.zit would touch the line withpytest-seleniumtoo.0.4.1Support for PyPI links that have a hash in the file URL.0.4.1Fix PackageError if no Python version is defined.0.4Add filtering of package releases by Python version.0.3Issue a warning for users of Python before version 2.7.9.0.2Last character asinglenewline. Not two.0.1First, hopefully, working version.