pyodide / pyodide/pyodide

Dev REPL package checksum verification failure

Open
#2,609 18 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
14.8k
Forks
1k
Avg merge
20h 29m
Merged PRs (30d)
19

Description

Currently, I'm getting a checksum verification failure when installing numpy in the [dev REPL](https://pyodide.org/en/latest/console.html)

The error is,
```
None of the “sha256” hashes in the integrity attribute match the content of the subresource.
```

I suspect this is because the dev deployment has a cache duration of 1 hour and we overwrite files, so sometimes `packages.json` and actual packages might get temporarily out of sync and we would get these errors.

I'm not sure if there is much we can do about it:
- As far as I can tell after checking a few commits, package build is mostly reproducible and sha256 of packages remain constant unless there are build-related changes that are not very frequent.
- We can reduce the cache duration but then we would pay more in bandwidth if anyone uses dev packages extensively (right now there is no breakout of usage per deployed version)
- Otherwise, we could disable sha256 verification on dev deployment but it's also not ideal

So hopefully this issue will resolve itself in the near future, opened it for future reference.

cc @amitsaha

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.