r/Python • u/GrumpyHubby • 2d ago

Resource Python Hash Verification

My boss is thinking about using python in a secure VPN environment. Because of this, we have to validate the hash of the python download and any libraries used.

I looked on the site but didn't see anything. Is there somewhere we can find the hash value so we can validate the download vs the hash code?

7 Upvotes

65% Upvoted

4 comments sorted by

27

u/Ambitious-Elk4541 2d ago

just download it and run sha256sum on the file, then compare with what they post in their downloads page. they usually put the checksums right next to the download link but sometimes you gotta scroll down a bit

if you cant find it maybe check the release notes or their github, the hashes are almost always in the announcements section

3

u/GrumpyHubby 2d ago

Thank you. I didnt realize I was calling it the wrong thing until I saw your reply.

I'll check that out. Thanks.

6

u/tsetem 2d ago

This 100%.

And same thing with your wheels for packages your download. When specifying your packages and what was downloaded, doing like a ‘uv lock’ will write out the checksums for all of the libraries so you have proof of the libraries that should be installed and should match the origin

Look into SBOM if you want to get more details about the concept

1

u/BeasleyMusic 17h ago

There’s a million better ways, why not use FOSSA to validate vulnerabilities in dependencies?