[issue14280] packaging.pypi should not require checksums

Changes by Éric Araujo : -- resolution: -> out of date stage: -> committed/rejected status: open -> closed ___ Python tracker ___ __

[issue14280] packaging.pypi should not require checksums

Alexis Metaireau added the comment: Right, I'll go for this then. -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubsc

[issue14280] packaging.pypi should not require checksums

Jim Fulton added the comment: I just clarified that 14279 doesn't imply local files. I'd be fine with a warning about lack of checksums for downloads. -- ___ Python tracker ___

[issue14280] packaging.pypi should not require checksums

Alexis Metaireau added the comment: If no MD5 checksum is present on the crawled simple index, then we don't have to check them. This means we introduce a potential security hole here (md5 checksums were added for a reason). What could be done is to explicitely don't check them if asked so. F

[issue14280] packaging.pypi should not require checksums

Éric Araujo added the comment: I’m not sure that this report should not be merged with #14279, but Alexis will judge that. -- assignee: eric.araujo -> alexis title: simple indexes (in wrappers) should not require md5 hashes -> packaging.pypi should not require checksums versions: +3rd