Repeatable installs via hashing

pip/cmdoptions.py

@@ -10,6 +10,7 @@
 from __future__ import absolute_import
 
 from functools import partial
+import hashlib
 from optparse import OptionGroup, SUPPRESS_HELP, Option
 import warnings
 
@@ -523,6 +524,47 @@ def only_binary():
 )
 
 
+def _good_hashes():
+    """Return names of hashlib algorithms at least as strong as sha256."""
+    # Remove getattr when 2.6 dies.
+    algos = set(
+        getattr(hashlib,
+                'algorithms',
+                ('md5', 'sha1', 'sha224', 'sha256', 'sha384', 'sha512')))
+    return algos - set(['md5', 'sha1', 'sha224'])
+
+
+def _merge_hash(option, opt_str, value, parser):
+    """Given a value spelled "algo:digest", append the digest to a list
+    pointed to in a dict by the algo name."""
+    if not parser.values.hashes:
+        parser.values.hashes = {}
+    try:
+        algo, digest = value.split(':', 1)
+    except ValueError:
+        parser.error('Arguments to %s must be a hash name '
+                     'followed by a value, like --hash=sha256:abcde...' %
+                     opt_str)
+    goods = _good_hashes()
+    if algo not in goods:
+        parser.error('Allowed hash algorithms for %s are %s.' %
+                     (opt_str, ', '.join(sorted(goods))))
+    parser.values.hashes.setdefault(algo, []).append(digest)
+
+
+hash = partial(
+    Option,
+    '-H', '--hash',
+    # Hash values eventually end up in InstallRequirement.hashes due to
+    # __dict__ copying in process_line().
+    dest='hashes',
+    action='callback',
+    callback=_merge_hash,
+    type='string',
+    help="Verify that the package's archive matches this "
+         'hash before installing. Example: --hash=sha256:abcdef...')
+
+
 ##########
 # groups #
 ##########

pip/commands/install.py

@@ -159,6 +159,14 @@ def __init__(self, *args, **kw):
 
         cmd_opts.add_option(cmdoptions.no_clean())
 
+        cmd_opts.add_option(
+            '--require-hashes',
+            dest='require_hashes',
+            action='store_true',
+            help='Perform a provably repeatable installation by requiring a '
+                 'hash to check each package against. Implied by the presence '
+                 'of a --hash option on any individual requirement')
+
         index_opts = cmdoptions.make_option_group(
             cmdoptions.index_group,
             self.parser,
@@ -266,6 +274,7 @@ def run(self, options, args):
                     pycompile=options.compile,
                     isolated=options.isolated_mode,
                     wheel_cache=wheel_cache,
+                    require_hashes=options.require_hashes,
                 )
 
                 self.populate_requirement_set(