Change the hashes in the installation report to be a mapping

What’s the problem this feature will solve?

Currently, pip install --report generates hash information that looks like:

        "archive_info": {
          "hash": "sha256=18f3e912f9ad1bdec27fb06b8198a2ccc32f201e24174cec1b3424dda605a310"
        }

This means that we can’t show hash information with multiple algorithms easily.

Describe the solution you’d like

Change archive information into being a mapping of hashes, similar to PEP 691:

      "hashes": {"sha256": "...", "blake2b": "..."},

We can put this key in archive_info, and replace the existing hash key with it.

Alternative Solutions

Not really. The other option is doing something like adding & as a separator between hashes, but that sounds like a horrible thing to do given the alternatives we have and that we’re allowed to make backwards incompatible changes right now.

Additional context

N/A

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[sbidoul]

I think this change will be backward compatible, though, as I plan to propose new a hashes field to the PEP 610 data structure, while keeping hash for backward compatibility.

[sbidoul]

Of course we could do without changing PEP 610.

Yet let me add these arguments:

• the installation report is not an interoperability standard but it composes interoperability standards to ease consumption (as well as production)
• download_info is explicitly documented as being PEP 610 compliant
• diverging from it will make the implementation and documentation much more complex
• it will make it harder to consume for our users
• the fact that PEP 610 supports a single hash only is clearly an oversight

I’ll try to prepare an amendment PEP 610 and I’ll see how well it fits.