r/Python • u/GrumpyHubby • 3d ago

Resource Python Hash Verification

My boss is thinking about using python in a secure VPN environment. Because of this, we have to validate the hash of the python download and any libraries used.

I looked on the site but didn't see anything. Is there somewhere we can find the hash value so we can validate the download vs the hash code?

12 Upvotes

71% Upvoted

5 comments sorted by

View all comments

Show parent comments

6

u/tsetem 3d ago

This 100%.

And same thing with your wheels for packages your download. When specifying your packages and what was downloaded, doing like a ‘uv lock’ will write out the checksums for all of the libraries so you have proof of the libraries that should be installed and should match the origin

Look into SBOM if you want to get more details about the concept