Add installer hashes to info.json by Jrice1317 · Pull Request #1327 · conda/constructor

Jrice1317 · 2026-08-12T18:09:30Z

Description

Adds installer hashes to info.json so downstream tooling can use it as a single source of truth for installer checksums.

Changes:

Calculate requested installer hashes once and reuse them across build outputs.
Always include SHA256 in info.json; include additional algorithms requested by hash.
Refactor hash_files() to calculate multiple algorithms in one pass.
Preserve existing checksum file output.
Update schema, docs, and tests

Test expectations:

If only info.json is requested → expect SHA256 in _installer_hashes.
If only MD5 is requested → expect MD5 and the .md5 checksum file.
If both info.json and MD5 requested → expect SHA256 and MD5 to be calculated once and reused.
If neither is requested → expect no installer hashes to be calculated.
If multiple algorithms are requested → expect all hashes to be calculated in one pass.
If info.json and checksum files are generated → expect their hash values to match.
Existing SH installer MD5 behavior remains unchanged.

Checklist - did you ...

Add a file to the news directory (using the template) for the next release's release notes?
Add / update necessary tests?
Add / update outdated documentation?

lrandersson · 2026-08-13T11:58:56Z

    "build_outputs": {
      "default": [],
-      "description": "Additional artifacts to be produced after building the installer. It expects either a list of strings or single-key dictionaries.\nAllowed strings / keys: `hash`, `info.json`, `licenses`, `lockfile`, `pkgs_list`.",
+      "description": "Additional artifacts to be produced after building the installer. It expects either a list of strings or single-key dictionaries.\nRequesting `info.json` adds an `_installer_hashes` property containing the SHA256 digest of the generated installer. Hash algorithms requested through a `hash` build output are also included in this property.\nFor example:\n```json\n\"_installer_hashes\": {\n  \"sha256\": \"...\",\n  \"md5\": \"...\"\n}\n```\nThe `hash` output continues to create separate checksum files.\nAllowed strings / keys: `hash`, `info.json`, `licenses`, `lockfile`, `pkgs_list`.",


I wonder if we should not mention this here. I do think the information per say is good but as far as I can see we dont have any place right now explaining the contents of info.json - because of this it seems out of place.

Should I remove the whole thing or just the hardcoded example? I thought this was a good place because we do list info.json as an option in the schema here. However, I could see how my addition could be a little too detailed.

I'd say remove the whole thing.

lrandersson · 2026-08-13T12:33:06Z

+    algorithms = set(algorithms)
+    invalid = algorithms.difference(hashlib.algorithms_available)
+    if invalid:
+        raise ValueError(f"Invalid algorithm: {', '.join(sorted(invalid))}")


These needs to be singular/plural based on len(invalid).

lrandersson · 2026-08-13T12:35:44Z

+    if invalid:
+        raise ValueError(f"Invalid algorithm: {', '.join(sorted(invalid))}")
+
+    BUFFER_SIZE = 65536


Whats the rationale here for changing to 64KB instead of 256KB (262144 below)?

I didn't change it. I only copied over what was already in build_outputs.py here. With that being said, if it should be changed to 262144 instead, then just let me know. 😃

lrandersson · 2026-08-13T12:37:01Z

@@ -0,0 +1,19 @@
+### Enhancements
+
+* Add installer hashes to `info.json` making it the single source of truth for installer checksums used in SBOM generation. (#1327)


Suggested change

* Add installer hashes to `info.json` making it the single source of truth for installer checksums used in SBOM generation. (#1327)

* Add installer hashes to `info.json` making it the single source of truth for installer checksums. (#1327)

I propose that we skip the last part since in theory users don't need to know the connection to SBOM generation.

marcoesters · 2026-08-13T15:22:22Z

+            if isinstance(algorithm, str):
+                algorithms.add(algorithm)
+            elif algorithm:
+                algorithms.update(algorithm)


We need to validate that the hash algorithms are valid. It looks like that part of the code got removed.

It didn't get removed completely. It got moved here.

Ah, yes, thanks for pointing that out! It looks like the test catching that ValueError got removed though, so we are missing some test coverage.

marcoesters · 2026-08-13T15:29:14Z

+        outpath = Path(f"{installer}.{algo}")
+
+        with open(outpath, "w", newline="\n") as f:
+            f.write(f"{info['_installer_hashes'][algo]}  {installer.name}\n")


This should have a guard to make sure we don't have an uncaught exception here. That way, we can have a more meaningful error message.

Co-authored-by: Robin <34315751+lrandersson@users.noreply.github.com>

Jrice1317 added 10 commits August 6, 2026 15:04

Move hash file calculation to utils for reusability

62ae7e0

Calculate hashes once for all requested outputs

fbd2483

Add installer hashes to info.json

ec672e7

Update schema and docs

8ed2fbb

Merge remote-tracking branch 'upstream/main' into hashes

7d329d0

Handle single and multiple hashes

b9053c7

Inetegration test verifying sha256 and md5

f2db448

Update tests based off hash selection

5b9304e

Update logic

fc8dc6e

Ensure multiple paths still produce one digest

a57f9ef

conda-bot added this to 🔎 Review Aug 12, 2026

github-project-automation Bot moved this to 🆕 New in 🔎 Review Aug 12, 2026

conda-bot added the cla-signed [bot] added once the contributor has signed the CLA label Aug 12, 2026

Jrice1317 added 5 commits August 12, 2026 11:15

Fix typos and pre-commit errors

2332500

Pre-commit fix

4f5dd03

Add news file

6769a71

Fix tests

f6a7f2a

Update docs

8b90819

Jrice1317 marked this pull request as ready for review August 13, 2026 02:23

Jrice1317 requested a review from a team as a code owner August 13, 2026 02:23

lrandersson reviewed Aug 13, 2026

View reviewed changes

marcoesters reviewed Aug 13, 2026

View reviewed changes

Jrice1317 and others added 2 commits August 13, 2026 09:03

Apply suggestions from code review

ffebc34

Co-authored-by: Robin <34315751+lrandersson@users.noreply.github.com>

Apply code review suggestions, add imports, and update docs

f121a15

Navigation Menu

Uh oh!

Add installer hashes to info.json - #1327

Add installer hashes to info.json#1327
Jrice1317 wants to merge 17 commits into
conda:mainfrom
Jrice1317:hashes

Jrice1317 commented Aug 12, 2026 •

edited

Loading

Uh oh!

lrandersson Aug 13, 2026

Uh oh!

marcoesters Aug 13, 2026

Uh oh!

Jrice1317 Aug 13, 2026

Uh oh!

marcoesters Aug 13, 2026

Uh oh!

Uh oh!

lrandersson Aug 13, 2026

Uh oh!

lrandersson Aug 13, 2026

Uh oh!

Jrice1317 Aug 13, 2026

Uh oh!

lrandersson Aug 13, 2026

Uh oh!

marcoesters Aug 13, 2026

Uh oh!

Jrice1317 Aug 13, 2026

Uh oh!

marcoesters Aug 13, 2026

Uh oh!

marcoesters Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1,19 @@
		### Enhancements

		* Add installer hashes to `info.json` making it the single source of truth for installer checksums used in SBOM generation. (#1327)

Uh oh!

Conversation

Jrice1317 commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes:

Test expectations:

Checklist - did you ...

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Jrice1317 commented Aug 12, 2026 •

edited

Loading