Skip to content

fix(index): include available SHA256 hashes in wheel links - #2409

Open
hakarrr wants to merge 4 commits into
abetlen:mainfrom
hakarrr:pep503-asset-digests
Open

hakarrr wants to merge 4 commits into
abetlen:mainfrom
hakarrr:pep503-asset-digests

Conversation

@hakarrr

@hakarrr hakarrr commented Nov 10, 2026

Copy link
Copy Markdown

Related to #1340.

The wheel-index generator currently discards release-asset digests. This adds #sha256=... fragments when GitHub supplies a valid SHA256 digest, so installers can check the downloaded wheel against it.

  • Preserve the existing link and label when the digest is missing, null, malformed, or not SHA256.
  • Keep non-wheel filtering, backend release patterns, and empty indexes working.
  • Add offline tests that run the real shell script with release-JSON fixtures. No release binaries are downloaded.

This does not backfill hashes for historical assets without a usable digest, so it is a partial improvement toward #1340 rather than complete historical coverage.

Validation

On Python 3.11, Bash and jq:

  • python -m pytest tests/test_release_index.py -q: 17 passed, no skips. The same tests against the unchanged generator give 4 failed and 13 passed.
  • python -m ruff check llama_cpp tests: passed.
  • python -m ruff format --check llama_cpp tests: passed.
  • bash -n scripts/releases-to-pep-503.sh: passed.
  • git diff --check: passed.

Rechecked all three published files against the tested local files byte-for-byte, then ran the checks again from the fetched branch. The native/model inference suite was not run; no native or inference code changes. These new script tests skip explicitly if Bash or jq is unavailable.

References: GitHub release-asset digests and the Simple Repository API.

hakarrr and others added 4 commits November 11, 2026 02:55
Use valid release-asset digests while preserving links for assets without usable SHA256 values.

Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>
Exercise the real shell generator with offline release JSON fixtures, including missing and unusable digests, mixed assets, backend filters, and empty indexes.

Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>
Reference the maintainer's issue without claiming complete historical hash coverage.

Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>
Use the assigned pull request number in the repository's changelog format.

Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant