My boss is thinking about using python in a secure VPN environment. Because of this, we have to validate the hash of the python download and any libraries used.
I looked on the site but didn't see anything. Is there somewhere we can find the hash value so we can validate the download vs the hash code?
8 comments · 69% upvoted · other discussions
There’s a million better ways, why not use FOSSA to validate vulnerabilities in dependencies?
All of this is the first time I heard of doing this. I had seen the hashes in the past but never paid them any attention. So this is all new to me in how it works.
python.org has sha256 checksums for every release, and gpg signatures too up through 3.13. 3.14 and later ditched gpg for sigstore instead, so just check which one applies to whatever version youre actually pulling
Python uses now sigstore instead of GPG.
Install sigstore: py -m pip install sigstore
Command to check:
python -m sigstore verify identity python-3.15.2-amd64.exe --certificate python-3.15.2-amd64.exe.crt --signature python-3.15.2-amd64.exe.sig --cert-identity [[email protected]](mailto:[email protected]) --cert-oidc-issuer https://github.com/login/oauth
And yes, 3.15.2 is out.
To upgrade with Python install manager: py install --upgrade
each version's release page on python.org has an md5 column next to every file, and a sigstore column too if you need something stronger than md5
just download it and run sha256sum on the file, then compare with what they post in their downloads page. they usually put the checksums right next to the download link but sometimes you gotta scroll down a bit
if you cant find it maybe check the release notes or their github, the hashes are almost always in the announcements section
tsetem 7 points · 7d ago
This 100%.
And same thing with your wheels for packages your download. When specifying your packages and what was downloaded, doing like a ‘uv lock’ will write out the checksums for all of the libraries so you have proof of the libraries that should be installed and should match the origin
Look into SBOM if you want to get more details about the concept
GrumpyHubby [OP] 3 points · 7d ago
Thank you. I didnt realize I was calling it the wrong thing until I saw your reply.
I'll check that out. Thanks.