Skip to content

Add digests to relevant files #47

Open

Description

@chrahunt

From pypa/pip#5658, we could provide digests so users can verify that get-pip.py was downloaded correctly.

One use case could be during manual configuration of some server that does not have root CA certificates installed:

  1. Execute curl --insecure -o get-pip.py https://bootstrap.pypa.io/get-pip.py on the server
  2. Run sha256sum get-pip.py
  3. Navigate to https://bootstrap.pypa.io/get-pip.py.sha256 in a web browser
  4. Compare the contents of that page with the output of sha256sum

Activity

  1. pradyunsg commented on Sep 5, 2019

    @pradyunsg
    Member

    Same as #41.

  2. chrahunt commented on Sep 5, 2019

    @chrahunt
    MemberAuthor

    Not necessarily. That will result in a *.asc next to the file containing the signature, which serves a different use case. Compare the digests and signatures on the Python download page, for example.

  3. pradyunsg commented on Sep 5, 2019

    @pradyunsg
    Member

    Indeed. I misread in a hurry. Sorry!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions