Implement a --verify-hashes hash-checking mode (#4007)

## Summary

This is an alternative to `--require-hashes` which will validate a hash
if it's present, but ignore requirements that omit hashes or are absent
from the lockfile entirely.

So, e.g., transitive dependencies that are missing will _not_ error; nor
will dependencies that are included but lack a hash.

Closes https://github.com/astral-sh/uv/issues/3305.
This commit is contained in:
Charlie Marsh 2024-07-17 17:25:31 -04:00 committed by GitHub
parent ba4e2e3d2a
commit 82d94838cb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
14 changed files with 482 additions and 85 deletions

View file

@ -182,7 +182,8 @@ impl<'a, Context: BuildContext> SourceTreeResolver<'a, Context> {
let hashes = match self.hasher {
HashStrategy::None => HashPolicy::None,
HashStrategy::Generate => HashPolicy::Generate,
HashStrategy::Validate { .. } => {
HashStrategy::Verify(_) => HashPolicy::Generate,
HashStrategy::Require(_) => {
return Err(anyhow::anyhow!(
"Hash-checking is not supported for local directories: {}",
path.user_display()