Dev REPL package checksum verification failure
- Dominant language
- Python
- Stars
- 14.8k
- Forks
- 1k
- Avg merge
- 20h 29m
- Merged PRs (30d)
- 19
Description
Currently, I'm getting a checksum verification failure when installing numpy in the [dev REPL](https://pyodide.org/en/latest/console.html)
The error is,
```
None of the “sha256” hashes in the integrity attribute match the content of the subresource.
```
I suspect this is because the dev deployment has a cache duration of 1 hour and we overwrite files, so sometimes `packages.json` and actual packages might get temporarily out of sync and we would get these errors.
I'm not sure if there is much we can do about it:
- As far as I can tell after checking a few commits, package build is mostly reproducible and sha256 of packages remain constant unless there are build-related changes that are not very frequent.
- We can reduce the cache duration but then we would pay more in bandwidth if anyone uses dev packages extensively (right now there is no breakout of usage per deployed version)
- Otherwise, we could disable sha256 verification on dev deployment but it's also not ideal
So hopefully this issue will resolve itself in the near future, opened it for future reference.
cc @amitsaha
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.