Pypi wheel republished?

[glasserc]

Sorry for filing this as a bug but I wasn't really sure how to report it.

Did the ec2-metadata package on pypi get updated? Our CI failed with an "invalid hash" error. I see that on pypi the wheel package was updated after the tarball. If this was intentional then I can just update the hash in the constraints file, I just want to make sure this isn't an event-stream sort of situation.

[adamchainz]

Yes this happened and was intentional. The original wheel upload that went with the tarball was marked as “universal,” ie that it would work on Python 2 as well as 3, which isn’t true. I pulled it and uploaded a Python 3 only wheel. You can see the commit on master for the change and check the GPG signatures I upload to PyPI too though they aren’t surfaced well on the new PyPI design. Also wheels are just zips so if you are worried about their contents you can download, unzip and inspect ;)

On Tue, 5 Feb 2019 at 19:08, Ethan Glasser-Camp ***@***.***> wrote: Sorry for filing this as a bug but I wasn't really sure how to report it. Did the ec2-metadata package on pypi get updated? Our CI failed <https://circleci.com/gh/mozilla-services/kinto-dist/2100> with an "invalid hash" error. I see that on pypi <https://pypi.org/project/ec2-metadata/#files> the wheel package was updated after the tarball. If this was intentional then I can just update the hash in the constraints file, I just want to make sure this isn't an event-stream sort of situation. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#114>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA0WCTb49L1MryXkYYzupIX49yo-mJ-Jks5vKdaggaJpZM4aj4Aj> .

-- Adam

[adamchainz]

And btw thanks for raising a query rather than just shrugging your shoulders and ignoring funny computer message. Investigating is what keeps us all secure.