pypi version 2.1.0 has been tampered with
neuhalje opened this issue · 1 comments
neuhalje commented
My build suddenly (after the holidays) started to fail because the hash of swagger-spec-validator==2.1.0 changed. Is this a legitimate change, or has someone tampered with the published version?
Virtualenv location:/--redacted--/.venv
Installing dependencies from Pipfile.lock (3ec315)…
An error occurred while installing swagger-spec-validator==2.1.0! Will try again.
...
Installing initially–failed dependencies…
Collecting swagger-spec-validator==2.1.0 — 00:00:00
Using cached swagger_spec_validator-2.1.0-py2.py3-none-any.whl
THESE PACKAGES DO NOT MATCH THE HASHES FROM Pipfile.lock!. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
swagger-spec-validator==2.1.0 from https://pypi.python.org/packages/44/02/bcc0122d561d9727b8ca476058f2c57a37a1c86d0f7c9aec5543f3219cd0/swagger_spec_validator-2.1.0-py2.py3-none-any.whl#md5=bc8fb6e9f29bc36dc050330f7ac184db (from -r /var/folders/12/vzps3jhs0pz8z_phldh9pz180000gn/T/pipenv-qfwotfvp-requirement.txt (line 1)):
Expected sha256 dc9219c6572ce0def6e1c160ca253c0e7fcde75812628f0c0199334f85bd138e
Got aedacb6c6b475026a1b5ac218fb590382d08064e227da254eb961d17cfd2b7c1
This is the change in my Pipfile:
diff --git a/Pipfile.lock b/Pipfile.lock
index 2eea162..cc4ef43 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -1,18 +1,18 @@
{
"_meta": {
"hash": {
- "sha256": "03f991c8243036005ea82f4af6c7bf75ef3ba6285370a8ef022c8ea686cd7f17"
+ "sha256": "a814905b3818590dc2fb345a0cb0f203cc8511ca2fac063e3a73c098593ec315"
},
"host-environment-markers": {
"implementation_name": "cpython",
- "implementation_version": "3.6.3",
+ "implementation_version": "3.6.4",
"os_name": "posix",
"platform_machine": "x86_64",
"platform_python_implementation": "CPython",
- "platform_release": "17.2.0",
+ "platform_release": "17.3.0",
"platform_system": "Darwin",
- "platform_version": "Darwin Kernel Version 17.2.0: Fri Sep 29 18:27:05 PDT 2017; root:xnu-4570.20.62~3/RELEASE_X86_64",
- "python_full_version": "3.6.3",
+ "platform_version": "Darwin Kernel Version 17.3.0: Thu Nov 9 18:09:22 PST 2017; root:xnu-4570.31.3~1/RELEASE_X86_64",
+ "python_full_version": "3.6.4",
"python_version": "3.6",
"sys_platform": "darwin"
},
@@ -22,6 +22,7 @@
},
"sources": [
{
+ "name": "pypi",
"url": "https://pypi.python.org/simple",
"verify_ssl": true
}
@@ -38,30 +39,30 @@
},
"aiohttp": {
"hashes": [
- "sha256:6fbafb8883fd943c253b17416cf564a82fd71f161ff700383b09879ba3cce622",
- "sha256:588fb25786bb006166f35e75e7dcfb096278f99f458c3e09400ed42f021a2c09",
- "sha256:22599849201671588ad62d536591e95d4052806c7c14d7c9ab7a23b2e8bc071f",
- "sha256:07446d6bb192a0fb42ab6204f34741cb269714abce64643cf649efd543e12960",
- "sha256:cbfe5c509aaa2eff789c4fee436e3c1920a94392b60f2e80c74af762c7479b07",
- "sha256:0580759823133cd4656a76239328363a8c12be26e9579ed75691b5aa46c61dc2",
- "sha256:83bc52dae14d43db1bfad1c1e1d47eab2d096fef0b5008850e30a71b736e8f40",
- "sha256:df827287fa962de0b3bbe8ea74fa3aa440dd7e1625743b247c0eaf9b9be3d647",
- "sha256:689c30f5de00798ce412b8624fe9fd243c1689a50b614a5b9ffa31dba87aa7e9",
- "sha256:e0aff15e4fa97c249290dc5fe8d784eeedf3f04a94a0125e6ca61dc14f8096a4",
- "sha256:59945743837ced78e3354e443718db2fd99ff0b7e0269f324ef9a3c942121352",
- "sha256:5507e614110a1a4ebed82d389ea50c2b4d98b24ec6b500503533081cf1892462",
- "sha256:d551a3ec5aee881677bf952f5e4ae75146f9bd71bbeae06c814ca00fb1cd2f41",
- "sha256:03848a3961fe7a5ba32fa9f40cfd5ecf139d6e85b59868412fed47d5835f098c",
- "sha256:764426debf452eb0a479717d68abbc88d0a707da58761784d4b532afd518027c",
- "sha256:0543261f22b7e635abeba354c9f975f877d471615b4e42c730d6894ddf008bf2",
- "sha256:df52fc09085f4a7b0952a8f2aef3aa0b15a16dd789e0bce8703043fdbd038f9d",
- "sha256:315c2e0dd2ef657b9142cb00cb77ff240192ce0b2e45e1b6e8f3a1d0dae24b66",
- "sha256:ba2b7d24425fe519f0fb6c9a11e192c47993e5a30943247b45d73f79764f1667",
- "sha256:52086829c4d7d6aac0a98455489c42296435d9ac1b607e27a4fbb1490a012a20",
- "sha256:4a7d2221e6d3a8bb8d510e6aa254fd8e165efecc42af5b699e1492ed9cad51e7",
- "sha256:044e4d610a5ab6bd46a04f431f000d0b5074f1aa38df5e326cff031635af6ad7"
- ],
- "version": "==2.3.5"
+ "sha256:1d3659809cc3cf16007a43df3c3af34a9ad8d7594bfcd651ef2d29ff21d015e3",
+ "sha256:18c93827f604e3830535423f22bfaa180d7ba10baa5959a2077f2e29b320138d",
+ "sha256:080c82112d93fe117a2f605d5a102191ae7fc52349c53cf6676efbfb8bd2d369",
+ "sha256:a1c29fdc56e040c3c67a9fa6da7e05382d5216d1ead9ae8a4fb772a1abb0452a",
+ "sha256:d8f546159ae453572c3b87d88652705c4516dfee1ade8673b47f544b2bf1b33d",
+ "sha256:03085220b503bb2cf2d288e1b36cf6dcbf84fcfed550e7c73bad429a6e528084",
+ "sha256:00e40b1261bdb6a1e2b986e610be8a2bb0699ce5a261f78c88d761c726e0af10",
+ "sha256:fcec0a4878c27f04bf62de4b76d51f9583d45031317dd020088d2e258210fcc2",
+ "sha256:52b180767e1b75ff071f316a52946fb311ba4183cb6981201fa7843611cf42e4",
+ "sha256:1fbc4701639ca383dc103840fb478ce726b84c51de8d575c02b740bcb2f60262",
+ "sha256:9d2e10768bca6ff8392df596754adbffee39ab4243d2536f955f9db145685cbe",
+ "sha256:3ee498748106c2f8ce937ea27c05d8862118ce055ee3d074b383e927572b51b6",
+ "sha256:dc922785064187c45c71eda21d7eb87c7a0b2d867e0d7c9ffc2ea2a37dcca608",
+ "sha256:0415ca37ca047d4b5c2938da024abe4893fe54227b7ad36f98fb169fff4767a3",
+ "sha256:08715cc8d0ae00679b7c131804ae92aacc31fd0078dd0d78c309c043a4f8aa57",
+ "sha256:ed8fb8c9b16459895c6949215592df6119961a9999ade84b66594456883d2215",
+ "sha256:6b2c62e6d54a08c7e4b8b00251d3c877bdf10ceec22c7ecc5d94de64d75fe699",
+ "sha256:f81850cf4707a2d3d85fcb9c85c091a0df66bf4a67197530c5a4f454b8d1d950",
+ "sha256:5a1c7c890ac13dd05763e3617261f528fedf3255d72ba8c41e97f7de72f3d8b6",
+ "sha256:65d623d32a40826be88ecafe5a49fd0af3092b2bf7e1171aec1d3e7868c969c1",
+ "sha256:222634adcdcfda1aefafff198415df77946384d10696619f1b163cb36d03bc82",
+ "sha256:fe294df38e9c67374263d783a7a29c79372030f5962bd5734fa51c6f4bbfee3b"
+ ],
+ "version": "==2.3.7"
},
"altgraph": {
"hashes": [
@@ -79,10 +80,10 @@
},
"astroid": {
"hashes": [
- "sha256:39a21dd2b5d81a6731dc0ac2884fa419532dffd465cdd43ea6c168d36b76efb3",
- "sha256:492c2a2044adbf6a84a671b7522e9295ad2f6a7c781b899014308db25312dd35"
+ "sha256:badf6917ef7eb0ade0ea6eae347aed1e3f8f4c9375a02916f5cc450b3c8a64c0",
+ "sha256:71dadba2110008e2c03f9fde662ddd2053db3c0489d0e03c94e828a0399edd4f"
],
- "version": "==1.5.3"
+ "version": "==1.6.0"
},
"async-timeout": {
"hashes": [
@@ -93,10 +94,10 @@
},
"bravado-core": {
"hashes": [
- "sha256:072847bca20096d0c4caac1d60afc54df21f14b2945f747ee3852cca6f967569",
- "sha256:4c31aaf71e6fd039845cd326399cf8f519dec764a37a97b16f01ad9b23821fa2"
+ "sha256:3a816b05b2f4505ec6b139ceaaad4df227f63376e3fd751b8d994898b4d257d3",
+ "sha256:2397da418c09335fafde00462fa02deba50b174f59a8f706a2744221ffc3918c"
],
- "version": "==4.11.0"
+ "version": "==4.11.1"
},
"certifi": {
"hashes": [
@@ -203,9 +204,9 @@
},
"httptools": {
"hashes": [
- "sha256:f47f9870f19e3488e8def0898c46f87d36e5d59e90eb77d01453a6747cdab9f8"
+ "sha256:f50dcb27178416c3a4113e9e1b392be5d1ff56ae1e474fe80869ed8530505e4c"
],
- "version": "==0.0.9"
+ "version": "==0.0.10"
},
"idna": {
"hashes": [
@@ -291,9 +292,9 @@
},
"markdown": {
"hashes": [
- "sha256:73af797238b95768b3a9b6fe6270e250e5c09d988b8e5b223fd5efa4e06faf81"
+ "sha256:cfa536d1ee8984007fcecc5a38a493ff05c174cb74cb2341dafd175e6bc30851"
],
- "version": "==2.6.9"
+ "version": "==2.6.10"
},
"markupsafe": {
"hashes": [
@@ -315,6 +316,22 @@
],
"version": "==0.17.2"
},
+ "msgpack-python": {
+ "hashes": [
+ "sha256:637b012c9ea021de7a7a75d6ff5e82cfef6694babd7e14bb9a3adcb2a5bd52f0",
+ "sha256:658c1cd5dcf7786e0e7a6d523cd0c5b33f92e139e224bd73cb3a23ada618d2dc",
+ "sha256:920bbbaee07ad048a4d2b4160901b19775c61ef9439f856c74509e763a326249",
+ "sha256:e165006f7e3d2612f1bffe2f6f042ca317d8df724d8b72a39b14c2e46c67eaae",
+ "sha256:95d70edd50e3d2f6ea1189f77190e4a0172626e7405ddd1689f3f64814447cba",
+ "sha256:7e1b12ea0134460052fabcfaa0f488ec0fc21deb14832d66236fd2870757d8f1",
+ "sha256:8f36890251f20d96267618cf64735759d7ef7e91bc0b86b9480547d2d1397a68",
+ "sha256:1e68a277e4180baa7789be36f27f0891660205f6209f78a32282d3c422873d78",
+ "sha256:f52d9f96df952369fe4adcb0506e10c1c92d47f653f601a66da2a26a7e7141ea",
+ "sha256:58c9c1d7891a35bddc6ee5dbec10d347a7ae4983169c24fc5fc8a57ae792ca76",
+ "sha256:1a2b19df0f03519ec7f19f826afb935b202d8979b0856c6fb3dc28955799f886"
+ ],
+ "version": "==0.4.8"
+ },
"multidict": {
"hashes": [
"sha256:d12dfcff45b5c0eb3d586289cbf928012e75f93f10f4b9d7af903acb07b3c226",
@@ -394,16 +411,16 @@
},
"pyinstaller": {
"hashes": [
- "sha256:b6c95cdbb45ac78a44723fa2992b58e14637cbefecafc22d3790af262a7fad6f"
+ "sha256:715f81f24b1ef0e5fe3b3c71e7540551838e46e9de30882aa7c0a521147fd1ce"
],
- "version": "==3.3"
+ "version": "==3.3.1"
},
"pylint": {
"hashes": [
- "sha256:948679535a28afc54afb9210dabc6973305409042ece8e5768ca1409910c1ed8",
- "sha256:1f65b3815c3bf7524b845711d54c4242e4057dd93826586620239ecdfe591fb1"
+ "sha256:c8e59da0f2f9990eb00aad1c1de16cd7809315842ebccc3f65ca9df46213df3b",
+ "sha256:3035e44e37cd09919e9edad5573af01d7c6b9c52a0ebb4781185ae7ab690458b"
],
- "version": "==1.7.4"
+ "version": "==1.8.1"
},
"pytest": {
"hashes": [
@@ -461,10 +478,10 @@
},
"pytest-xdist": {
"hashes": [
- "sha256:997ed2d6ed487fc41e16b5a0d00b944574a2f635375ee7fbea6a1d6b3876e2cd",
- "sha256:433e82f9b34986a4e4b2be38c60e82cca3ac64b7e1b38f4d8e3e118292939712"
+ "sha256:74b18cc78abb334bfaaac223d82565be1ebcecf85c66a3cabe3ede8f86e16943",
+ "sha256:0b8622435e3c0650a8d5a07b73a7f9c4f79b52d7ed060536a6041f0da423ba8e"
],
- "version": "==1.20.1"
+ "version": "==1.21.0"
},
"python-dateutil": {
"hashes": [
@@ -612,10 +629,10 @@
},
"tqdm": {
"hashes": [
- "sha256:733ce813ab83e17a03da34043c6265e29f6731e3cbbbe305b12694ced0af6770",
- "sha256:7ca803c2ea268c6bdb541e2dac74a3af23cf4bf7b4132a6a78926d255f8c8df1"
+ "sha256:4c041f8019f7be65b8028ddde9a836f7ccc51c4637f1ff2ba9b5813d38d19d5a",
+ "sha256:df32e6f127dc0ccbc675eadb33f749abbcb8f174c5cb9ec49c0cdb73aa737377"
],
- "version": "==4.19.4"
+ "version": "==4.19.5"
},
"twine": {
"hashes": [
@@ -624,13 +641,6 @@
],
"version": "==1.9.1"
},
- "u-msgpack-python": {
- "hashes": [
- "sha256:4b509782648fc563f85cef03887389c7fba3b077a47920a13d3d4ea78652ffd2",
- "sha256:2f31fc1b6dd8632c230ea7012470e40f77119f20999274dda6f1afa9c305e590"
- ],
- "version": "==2.4.1"
- },
"ujson": {
"hashes": [
"sha256:f66073e5506e91d204ab0c614a148d5aa938bdbf104751be66f8ad7a222f5f86"
@@ -706,21 +716,21 @@
},
"yarl": {
"hashes": [
- "sha256:bd2155dc2fec1c4703404387376863fd13cf5e080950b2ad2aa1145bcd65aa6a",
- "sha256:a4fa02a86aa753a7ae08525c76a5ea099fe246ec645b252a353c4e5c4e38fae5",
- "sha256:a2f7dbbfa3f360adced0116e600e24b0fbef4ff1a11235309818ac8c2aabddac",
- "sha256:e0157aca55a555bff824c2dc2d30c2a8adfa768e0ca8168f2b614920475522a0",
- "sha256:b2df0dd3db8b39a51e5a7856a3969166a140f7f316e05deea0c696f58a4472da",
- "sha256:fc5598d6bde4a2333109e9b90d246a61ef4a73e201329de0f0bcd7271d71b2dc",
- "sha256:366c2021db3ed548c4cebb2e1ff7cd7e22975e3bf31519464c11c257e80e056f",
- "sha256:58aba6b30e015f2731847eb608d0c38435a26a7c7eb8ca4111a39bd36b393bd0",
- "sha256:5bd238a100be1438a3797fe2e793001b641adcd239b033d73e680bd5d7e07520",
- "sha256:aac9baad9bc9a428d3abc1737862b2bfe818a6a3ccc6b8341dc62eb3b7f2b134",
- "sha256:2aa32de85de42407c1c949c5c0b998d3805ffd4531a9a3b2dc81c5b6a8174b91",
- "sha256:aa9db9e3bf718ea0c0905fa8076e07486b3357688181cb430674bf26f2ce0acd",
- "sha256:06b3a0d00aebf64b269a3410ec079386f5091e7603796da6644dff08f427737a"
- ],
- "version": "==0.15.0"
+ "sha256:05d7453ea302b67a5891cf9c940574bd5db15c476ecfbfcb165e95e79e0ec0b8",
+ "sha256:9bd33929a3cbbe28886f9345f5e29a438d8ec199a11cf988ef7a609eb8221c31",
+ "sha256:65bf0c1fded20f70692a3989bd099e5a795d7f2b44dff1a3735d4b80babf170d",
+ "sha256:e668662fa266c7109ebf37765cbcf305008d7767d34ee5e6ce3bd856bf58c757",
+ "sha256:d6030efee9533812cfda2198dcb916b863e1b4849ce69a00f979e16418473d16",
+ "sha256:2644e5ed81f2d82059d27718482d313bff7797fb684b74b9a540830fd017592a",
+ "sha256:222d60fcc8d108ef4af1ec6f0bdf923f24eeaf9dbfbb95676e8e2ef319479a1b",
+ "sha256:b03542089cee33e160e7af6a1d2adac014e81374192d4d69cc8fc69c39a13b5f",
+ "sha256:f8fcaf4eb76234c60e4ec9961b0980ffafe57c9a2475fa2077f2e065dbb26490",
+ "sha256:37f7fe43131f74e41aa77f304fbbd9185efc82323a88e1f67afec93761e9e13a",
+ "sha256:0a51e1bc70a9dea39fb474cab73987de6051788945f06b9dcc263c7b600d2607",
+ "sha256:1d40f4066b92f86b8dabdee19d82493bc97a760b46a17c2839f71ba7589129a0",
+ "sha256:2e4e1aec650ad80e73e7063941cd8aadb48e72487ec680a093ad364cc61efe64"
+ ],
+ "version": "==0.17.0"
}
}
}
sjaensch commented
I've uploaded a wheel for version 2.1.0, which wasn't present before. I'm not sure why the sha wouldn't match, as the wheel is built from the same version, but I assume that is the reason.