[Jugurtha]

That's pretty cool! I was playing last night and implemented resumable downloads[0] for pip so that it could pick up where it stopped upon a network disconnect or a user interruption. It sucks when large packages, especially ML related, fail at the last second and pip has to download from scratch. This tool would have been nice to have. Thanks a bunch,

- [0]: https://asciinema.org/a/1r8HmOLCfHm40nSvEZBqwm89k

[westurner]

It is important to check checksums (and signatures, if there are any) of downloaded packages prior to installing them; especially when resuming interrupted downloads.

Pip has a hash-checking mode, but it only works if the hashes are listed in the requirements.txt file, and they're the hashes for the target platform. Pipfile.lock supports storeing hashes for multiple platforms, but requirements.txt does not.

If the package hashes are retrieved over the same channel as the package, they can be MITM'd too.

You can store PyPi package hashes in sigstore.

There should be a way for package uploaders to sign their package before uploading. (This is what .asc signatures on PyPi were for. But if they are retrieved over the same channel, cryptographic signatures can also be MITM'd).

IMHO (1) twine should prompt to sign the package (with a DID) before uploading the package to PyPi, and (2) after uploading packages, twine should download the package(s) it has uploaded to verify the signature.

; TCP RESET and Content-Range doesn't hash resources.

[Jugurtha]

Thanks for the pointers. The diff is tiny and deals only with resuming downloads. i.e: everything else is left as is.