micropip integrity check failed in pyodide

[yu0A]

Failed to find a valid digest in the 'integrity' attribute for resource 'http://localhost:9000/node_modules/pyodide/micropip-0.5.0-py3-none-any.whl' with computed SHA-256 integrity 'KFZn0rkbV86HyQAlSLlknsu+HplrTX9Miq+rebxMs8A='. The resource has been blocked.

[ryanking13]

Could you share a little more detail and a code that we can reproduce the error?

[yu0A]

OK
Run this in a Vue template project.
`

{{ textOutput }}

<script> import { ref, onMounted } from "vue"; import { useCounterStore } from "src/stores/example-store"; import netImportUrl from "src/pythonScripts/net_import.py?url"; export default { setup() { const store = useCounterStore(); let pyodide = ref(null); let netImport = null; setTimeout(() => { store.setFooterNote( "要使用Python面向对象编程，首先要在脚本中定义类，再创建对象，然后再运行相关的逻辑。" ); // 加载Python环境 pyodide = store.pyodide; }, 10); onMounted(async () => { //读取本地脚本 netImport = await (await fetch(netImportUrl)).text(); textInput.value = netImport; }); // Python交互组件 let textInput = ref(""); let textOutput = ref("运行结果"); return { netImport, pyodide, store, textInput, textOutput, async runPython() { // store.setGlobalLoading(true); await pyodide.loadPackage("micropip"); await pyodide.loadPackage("numpy") pyodide.runPython(textInput.value); textOutput.value = pyodide.runPython(textInput.value); console.log(textOutput.value); // store.setGlobalLoading(false); }, }; }, }; </script>

`

[yu0A]

My further request is skipping the whl integrity check of micropip.xxx.whl

[yu0A]

I just uploaded a Quasar CLI Vite project so that you can reproduce this bug.
vue_quasar_admin

How to reproduce?

1. Deploy this project
2. Go to http://localhost:9000/#/pythonWangLuoDaoRu
3. The await pyodide.loadPackage("micropip"); in this page actually loadsmicropip-0.5.0-py3-none-any.whl from src/js/pyodide.
4. If you change the file to https://files.pythonhosted.org/packages/2a/2b/fb867ed1e62954e8b9d9211f9c6ce028d4f630cab779815279adde9e3fdd/micropip-0.5.0-py3-none-any.whl, you can reproduce this error.

[ryanking13]

If you change the file to https://files.pythonhosted.org/packages/2a/2b/fb867ed1e62954e8b9d9211f9c6ce028d4f630cab779815279adde9e3fdd/micropip-0.5.0-py3-none-any.whl, you can reproduce this error.

Oh, yes. It is expected error, as the sha256 checksum will change if you change the file. So you need to either,

1. Disable the behavior of checking the checksum by settings checkIntegrity options to false, or
2. Update the sha256 checksum inside the pyodide-lock.json

[yu0A]

I did not search out the word checkIntegrity. Could you provide a settings.js with default settings for me?

[ryanking13]

pyodide.loadPackage(<pkg_name>, { checkIntegrity: false })

[yu0A]

I get it.
Another question is, can I use a global setting config file to config the default settings of pyodide.loadPackage()? E.g. in Electron(Node) apps, developers hope that they can set { checkIntegrity: false } by default so that they can focus on front-end code development but keep whls unchanged.

[ryanking13]

No, currently, there is no global setting for it. Probably you can re-define pyodide.loadPackage such as:

const origLoadPackage = pyodide.loadPackage
pyodide.loadPackage = (...) => orignLoadPackage(..., {checkIntegrity: false})

?

[hoodmane]

you can re-define pyodide.loadPackage

This is the solution I would recommend as well.