Re: [Buildroot] [PATCH v3 2/3] package/pkg-python: derive PyPI site from blake2b-256 hash

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: James Hilliard <james.hilliard1@gmail.com>
Cc: buildroot@buildroot.org, Thomas Perale <thomas.perale@mind.be>,
	 Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Subject: Re: [Buildroot] [PATCH v3 2/3] package/pkg-python: derive PyPI site from blake2b-256 hash
Date: Mon, 14 Sep 2026 23:22:57 +0200	[thread overview]
Message-ID: <aqhkbaMkRynOxfoT@windsurf> (raw)
In-Reply-To: <20260618065137.3987932-2-james.hilliard1@gmail.com>

Hello,

On Thu, Jun 18, 2026 at 12:51:36AM -0600, James Hilliard wrote:
> Python packages downloaded from PyPI currently store the complete
> files.pythonhosted.org package path in their .mk file. That path is
> hash-based, so it changes for every version bump and adds churn to
> updates and backports.
> 
> When a Python package does not define _SITE, derive the hash-based
> files.pythonhosted.org site from the blake2b-256 entry matching the
> package source archive in the package .hash file before the generic
> package infrastructure validates _SITE.
> 
> Follow the usual target/host fallback pattern for _SITE, and raise an
> explicit error if no hash file is available or if the hash file does not
> contain a matching blake2b-256 entry. Add the host coreutils dependency
> for packages using this resolver so b2sum is available when needed for
> hash verification.
> 
> Update scanpypi to omit generated _SITE assignments so newly generated
> PyPI packages can use the resolver.
> 
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

I must say I am not a fan of this approach. It is very "tricky" and
not obvious to understand that the _SITE information is in some cases
derived from information in the .hash file. For me this breaks the
principle of "obviousness" that makes Buildroot generally quite nice
to work with. I don't really find the current situation problematic,
and what we have currently is completely obvious to use/understand.

Of course, if the other maintainers are happy with your approach, I
will not oppose. But since so far nobody provided feedback, I thought
I should share my humble feedback.

Another concern: I assume you're adding
$(BR2_COREUTILS_HOST_DEPENDENCY) to DOWNLOAD_DEPENDENCIES so that
'awk' is available? But then if we run "make show-info" without doing
any build, it means we no longer have the _SITE information?

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot