Binary hash in pypy changed for release 1.19.0

[nmacdonald]

It looks like the binaries and associated SHA1 hash for version 1.19.0 was updated on pypy on June 17, 2023 though 1.19.0 release was in January 2021. Should there be a different release number for these binaries?

PIP sync is failing with mismatched hashes for 1.19.0

[wimglenn]

No SHA1 were modified for the .tar.gz. There was no .whl file on PyPI before Jun 17, the update was adding a .whl file packaging for existing 1.19.0 (with no version number change since the code inside the archive is logically the same actually there were some unreleased bugfix commits on master, which I hadn't noticed).

How/why is pip-sync failing? Can you provide a reproducer for that?

[nmacdonald]

Thanks for the quick reply! Yep, this is the error message:

[pipenv.exceptions.InstallError]: ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
[pipenv.exceptions.InstallError]: parse==1.19.0 from https://files.pythonhosted.org/packages/41/d4/ba354b3ee3c38a4fb0d4a95e66c565e75a3924c57a558648ad0b905510d5/parse-1.19.0-py2.py3-none-any.whl (from -r /tmp/pipenv-v73yeg8w-requirements/pipenv-j9hu6l14-hashed-reqs.txt (line 38)):
[pipenv.exceptions.InstallError]: Expected sha256 9ff82852bcb65d139813e2a5197627a94966245c897796760a3a2a8eb66f020b
[pipenv.exceptions.InstallError]: Got 6ce007645384a91150cb7cd7c8a9db2559e273c2e2542b508cd1e342508c2601

I believe to reproduce would be the following requirement in a Pipfile.lock:
"parse": {
"hashes": [
"sha256:9ff82852bcb65d139813e2a5197627a94966245c897796760a3a2a8eb66f020b"
],
"version": "==1.19.0"
},
which we were using successfully prior to June 17.

[wimglenn]

An error here is strange because no hash has changed:

9ff82852bcb65d139813e2a5197627a94966245c897796760a3a2a8eb66f020b is the correct sha256 for parse-1.19.0.tar.gz
6ce007645384a91150cb7cd7c8a9db2559e273c2e2542b508cd1e342508c2601 is the correct sha256 for parse-1.19.0-py2.py3-none-any.whl

The first one remains the same as it was when released Jan 2021, and the second one is a new file. I'm not sure why it would compare the sdist hash to the wheel hash, those would always be different - seems like a bug in pipenv?

In hindsight, there were some bugfix commits sitting on master for the last 2 years unreleased, so this should have been a new version number anyway. I'll tag/publish a release 1.19.1, and you can update your requirements pins to parse==1.19.1

[wimglenn]

I've uploaded 1.19.1 and also created a post-release 1.19.0post0 from this branch for the wheel @ 1.19.0.

[nmacdonald]

We updated to 1.19.1. Thanks again!

[rectalogic]

oh man, yeah this broke us in production. I guess we need to do an unscheduled upgrade to fix...

Downloading parse-1.19.0-py2.py3-none-any.whl (18 kB)
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.

[wimglenn]

This sounds pretty much like pypa/pipenv#3893
It was closed in Apr 2022 so maybe you are still on an older version of Pipenv with that bug.