Poetry 1.1.8 does not include the security fix for mismatching package hashes

Hello, it appears to me that the latest Poetry release (1.1.8) does not contain this important security fix that makes Poetry actually check the hashes of downloaded files against the hashes in poetry.lock.

I tried to alter the hashes in my poetry.lock and reinstall one package on Poetry 1.1.8, and it did not complain. Also, it’s evident that this commit is not present in the chooser.py file in the release-1.1.8 branch, but it is present in the master version of the file.

It looks like some weird Git merging issue. Can we make sure this security fix gets included ASAP in the next release? Thank you 🙏🏼

[dougn]

Granted, now I get this error: • Installing auth-client (1.6.0): Failed

AttributeError

‘Link’ object has no attribute ‘name’

at ~/.pyenv/versions/3.7.9/lib/python3.7/site-packages/poetry/installation/executor.py:620 in _download_link 616│ ).hash() 617│ ) 618│ if archive_hash not in {f[“hash”] for f in package.files}: 619│ raise RuntimeError( → 620│ “Invalid hash for {} using archive {}”.format(package, archive.name) • Installing auth-client (1.6.0): Failed

AttributeError

‘Link’ object has no attribute ‘name’

WHY exactly auth-client, and another internal to my company package are failing the hash check is a different and scary question. This is on a fresh clean install with no lock file.

The hash being calculated here is sha256, but the one in the lock file is md5?

                "sha256:"
                + FileDependency(
                    package.name,
                    Path(archive.path) if isinstance(archive, Link) else archive,
                ).hash()

               auth-client = [
    {file = "auth-client-1.6.0.tar.gz", hash = "md5:8d31d21501d5c9636dabc81a170c8ce2"},
    {file = "auth_client-1.6.0-py3-none-any.whl", hash = "md5:5f48300ec0964ef5d72436647c6b4a8f"},
]

[pietrodn]

It is fixed in 1.1.9, I just checked that poetry install correctly detects a corrupt hash. Thanks!