zizmor 1.3.1 - ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE.

[ianlewis]

When installing zizmor via CI (GitHub and also on Netlify) I encountered a hash mismatch. I did have a later GHA run that succeeded so it's perhaps not consistent.

5:08:37 PM: Collecting zizmor==1.3.1 (from -r requirements.txt (line 16))
5:08:37 PM:   Downloading zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (4.7 MB)
5:08:37 PM:      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4.7/4.7 MB 77.3 MB/s eta 0:00:00
5:08:37 PM: [notice] A new release of pip is available: 24.3.1 -> 25.0.1
5:08:37 PM: [notice] To update, run: pip install --upgrade pip
5:08:37 PM: ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
5:08:37 PM:     zizmor==1.3.1 from https://files.pythonhosted.org/packages/c0/25/4be1fa0c99d5ce4751afba87d3ccea0385d9a307d0f05bd6aafb2b7b44a5/zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (from -r requirements.txt (line 16)):
5:08:37 PM:         Expected sha256 1a2f92d74c48c47fcf7aa0679bdc23fed437f61cc28553ab3f48f6d3392d9b8b
5:08:37 PM:              Got        8987e7a3f97f77b2d2b9a4b480e228918e9f9add2f55a99fecdb19ec52b73fe3

Downloading the same file locally produces the expected hash:

$ ./.venv/bin/pip download --no-cache-dir zizmor==1.3.1
Collecting zizmor==1.3.1
  Downloading zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (4.7 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4.7/4.7 MB 5.1 MB/s eta 0:00:00
Saved ./zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Successfully downloaded zizmor

$ ./.venv/bin/pip hash zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl 
zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:
--hash=sha256:1a2f92d74c48c47fcf7aa0679bdc23fed437f61cc28553ab3f48f6d3392d9b8b

The expected hash also appears correct on PyPI:

https://pypi.org/project/zizmor/1.3.1/#zizmor-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Is there a reason why this might be happening?

[ianlewis]

I'm running into a similar issue with 1.5.0

Collecting zizmor==1.5.0
  Downloading zizmor-1.5.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (4.8 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4.8/4.8 MB 102.3 MB/s eta 0:00:00
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
    zizmor==1.5.0 from https://files.pythonhosted.org/packages/79/56/481f25466a41d9bb6e0b70b0e059e5611a122b30937081653f69e435625e/zizmor-1.5.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (from -r requirements.txt (line 16)):
        Expected sha256 2251cc2aa93af78e19d19fc97e58dac9a21f444f441338bcee548298aab64ad0
             Got        29ea5d4cdcfd0848cdfb2f1279901e77824c2734287d5c561a3bca5d99ef6ded

https://pypi.org/project/zizmor/#zizmor-1.5.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

[ianlewis]

Downloading directly from the URL listed above also gives me the expected hash

$ curl -sSLJO "https://files.pythonhosted.org/packages/79/56/481f25466a41d9bb6e0b70b0e059e5611a122b30937081653f69e435625e/zizmor-1.5.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"

$ ./.venv/bin/pip hash zizmor-1.5.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl 
zizmor-1.5.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:
--hash=sha256:2251cc2aa93af78e19d19fc97e58dac9a21f444f441338bcee548298aab64ad0

[woodruffw]

Hey @ianlewis, thanks for opening a discussion!

I believe this tracks with an incident with PyPI's CDN: https://status.python.org/incidents/2zf08fkp0nd1

I also experienced this with non-zizmor packages, but it appears to have since been fixed. Let me know if you're still experiencing it, otherwise I'll close this in a few hours 🙂

[ianlewis]

Thanks! I hadn't seed the incident but that tracks. I'll go ahead and close this. Will re-open if I encounter this again or find evidence that it's a different issue.