News for hackers. Stuff that matters.

A comment on /story/34202662. Parent comment

Re: by Too on Sunday January 01, 2023 @01:31AM (#34204167)
It is possible to specify hashes. https://pip.pypa.io/en/stable/topics/secure-installs/
[ Parent | on HN ]
Re: by shanipribadi on Sunday January 01, 2023 @04:27AM (#34204941)
hashes would also need to be specified for all dependencies (transitives) in case they were needed,

and all dependencies need to be pinned to specific versions as well. hence this would only work when users are making use of venvs, instead of user install / site install setup.

[ Parent | on HN ]