Skip to main content

Double check sdist/bdist on pypi

Project description

Honesty

There's a long tail of people doing interesting/sketchy things to packages on pypi. Most aren't malicious, but this project gives you an easy way to check for some of the obvious ways that packages might be tampered with.

Usage

honesty list <package name>
honesty check <package name>[==version|==*] [--verbose]
honesty download <package name>[==version|==*] [--dest=some-path/]
honesty extract <package name>[==version|==*] [--dest=some-path/]
honesty license <package name>[==version|==*]

(provisional)
honesty ispep517 <package name>[==version|==*]
honesty native <package name>[==version|==*]
honesty age <package name>[==version|==*]

It will store a package cache, using the normal appdirs package to pick a location (on Linux, this defaults to ~/.cache/honesty/pypi but, you can override with XDG_CACHE_HOME or HONESTY_CACHE environment variables).

If you have a local bandersnatch, specify HONESTY_INDEX_URL to your /simple/ url. It also must support /pypi/<package>/json or pass --nouse-json to the commands that support it.

Exit Status of 'check'

These are bit flags to make sense when there are multiple problems. If you pass * for version, they are or'd together.

0   if only sdist or everything matches
1   if only bdist
2   (reserved for future "extraction error")
4   some .py from bdist not in sdist
8   some .py files present with same name but different hash in sdist (common
    when using versioneer or 2to3)

License

Honesty is copyright Tim Hatch, and licensed under the MIT license. I am providing code in this repository to you under an open source license. This is my personal repository; the license you receive to my code is from me and not from my employer. See the LICENSE file for details.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

honesty-0.2.1.tar.gz (21.5 kB view details)

Uploaded Source

Built Distribution

honesty-0.2.1-py2.py3-none-any.whl (15.1 kB view details)

Uploaded Python 2 Python 3

File details

Details for the file honesty-0.2.1.tar.gz.

File metadata

  • Download URL: honesty-0.2.1.tar.gz
  • Upload date:
  • Size: 21.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.2.0 requests-toolbelt/0.9.1 tqdm/4.40.0 CPython/3.8.0

File hashes

Hashes for honesty-0.2.1.tar.gz
Algorithm Hash digest
SHA256 9b38e5bf4fc885ce50d014d713b21e6610f1d0899ed3aa750ffa2b37f06f0a32
MD5 2bf7cb1db073b6e44dec625f7c08f5fc
BLAKE2b-256 ac0e5723d70bf11fb5203dc08b594742b162b31f5dd34164fef08abf943deec4

See more details on using hashes here.

File details

Details for the file honesty-0.2.1-py2.py3-none-any.whl.

File metadata

  • Download URL: honesty-0.2.1-py2.py3-none-any.whl
  • Upload date:
  • Size: 15.1 kB
  • Tags: Python 2, Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.2.0 requests-toolbelt/0.9.1 tqdm/4.40.0 CPython/3.8.0

File hashes

Hashes for honesty-0.2.1-py2.py3-none-any.whl
Algorithm Hash digest
SHA256 f06125e718e71dfbf17fe3aeb6826c5ad7a665ed8525eeea979822869a6731ee
MD5 09a55a3170d4cec331735c9edc2e8afb
BLAKE2b-256 529a71ae70639d46380cba1d9dd4335e773714f5b2418db1522b4f4a80c4b33c

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page