Private repository dependency isn't exported with sha256 hash

MD5 hashes aren’t supported by pip, and SHA256 hashes should be preferred for other reasons as well.

However, it appears that poetry doesn’t want to use/calculate the SHA256 hash for a package installed from a private repository.

All my other packages have the right type of hash embedded in the poetry.lock.

    {file = "vnxpy-3.10.0-py3-none-any.whl", hash = "sha256:5887fce95ca9ce304f86f7438b6a8d6b80d14895c8f3810fe6eb33b4b01c428c"},
]
warrant = [
    {file = "warrant-0.6.1-py2.py3-none-any.whl", hash = "sha256:a4099c566086be45d616ed4f58ed1567893ac74de125e201fc89c9023d8adf7d"},
    {file = "warrant-0.6.1.tar.gz", hash = "sha256:749bde7f775c077a64edfe21464654e0a39fc93dd76e27d5d2a61997b6dcaa0a"},
]
wcwidth = [
    {file = "wcwidth-0.1.7-py2.py3-none-any.whl", hash = "sha256:f4ebe71925af7b40a864553f761ed559b43544f8f71746c2d756c7fe788ade7c"},
    {file = "wcwidth-0.1.7.tar.gz", hash = "sha256:3df37372226d6e63e1b1e1eda15c594bca98a22d33a23832a90998faa96bc65e"},
]
wrapt = [
    {file = "wrapt-1.11.2.tar.gz", hash = "sha256:565a021fd19419476b9362b05eeaa094178de64f8361e44468f9e9d7843901e1"},
]
xoipy = [
    {file = "xoipy-1.27.1-py3-none-any.whl", hash = "md5:d39b851928a9056177cf8922772ce0b0"},
    {file = "xoipy-1.27.1.tar.gz", hash = "md5:238aa209e50aca1f90ada7a126a10327"},
]

Note xoipy, which has md5s specified. The repository itself provides the SHA256 sums, though I have not yet found the code that actually pulls those down, so I can’t confirm that poetry is receiving them. If/when I do, I will update this report.

[adawalli]

Note xoipy, which has md5s specified. The repository itself provides the SHA256 sums, though I have not yet found the code that actually pulls those down, so I can’t confirm that poetry is receiving them. If/when I do, I will update this report.

Did you find any work around @petergaultney ? This is burning my team badly as well…

[matejsp]

Just for reference same issue with Nexus: https://issues.sonatype.org/browse/NEXUS-24127