Hash Checking in setup.py install requires

Question

According to pip documentation, it is possible to specify the hash of a requirement in the requirements.txt file. Is it possible to get the same by specifying the hash in the setup.py so that the hash is checked when someone simply does pip install <package>?. I'm specifying the requirements in the setup.py by passing the install_requires keyword argument to the setup function in the distutils package.

from distutils.core import setup
from setuptools import find_packages

setup(name='<package-name>',
      ...
      ...
      install_requires=['ecdsa==0.13', 'base58==0.2.5']

Maybe there is another way to achieve the same but i couldn't find any documentation.

Answer 1

Currently, I don't believe there is a simple way to specify a hash check within setup.py. My solution around it is to simply use virtualenv with hashed dependencies in requirements.txt. Once installed in the virtual environment you can run pip setup.py install and it will check the local environment (which is your virtual environment) and the packages installed is hashed.

Inside requirements.txt your hashed packages will look something like this:

requests==2.19.1 \
--hash=sha256:63b52e3c866428a224f97cab011de738c36aec0185aa91cfacd418b5d58911d1 \
--hash=sha256:ec22d826a36ed72a7358ff3fe56cbd4ba69dd7a6718ffd450ff0e9df7a47ce6a

Activate your virtualenv and install requirements.txt file:

pip install -r requirements.txt --require-hashes