v2.32.5 wheel file hash doesn't match between PyPI and CI

[EpicWink]

Looking at the hashes of the wheel in PyPI (and in the GitHub release) and the hash of the uploaded build artefact from the v2.32.5 publish workflow run, they differ:

• PyPI: 2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6
• GitHub CI: 0f39b052d7ba3d55645a49019311390fc576ea7c2a594f56eb9b67a5388a6e84

I would guess that this is because when the publish CI job failed, the distributions were build locally and uploaded manually. In the future, I suggest fetching the build distributions from GitHub CI build artefacts, and publishing those.

[nateprewitt]

Hi @EpicWink, that's correct. This was the first attempted release with the GHA trusted publisher workflow but there are some configuration issues as you noted.

We manually published the local artifacts until we're able to resolve the config issue. When you're checking the hashes, are they the ones included in the GH release or are you seeing them published elsewhere?

[EpicWink]

When you're checking the hashes, are they the ones included in the GH release or are you seeing them published elsewhere?

@nateprewitt In general, I check that the hash in PyPI matches the hash in my generated lock file.

When the wheel was published with trusted publishing and attestations, I simply go to the commit in the attestation and verify things.

When the wheel was published without trusted publishing and attestations, I check that the hash in PyPI matches the hash of the wheel generated by CI (either by looking the CI logs, or by downloading the build artefact and computing the hash locally). I then verify the commit which CI was run from. If there's no CI, I have to tediously verify the entire downloaded wheel.

I don't generally care about the files in the GitHub release because anyone can upload them from anywhere.

[miketheman]

@nateprewitt The publishing failing points to a mismatch in configuration. See https://docs.pypi.org/trusted-publishers/troubleshooting/#:~:text=If%20you%27re%20using%20GitHub%20Actions%2C%20check%20if%20the%20workflow%20is%20using%20the%20same%20environment%20as%20configured%20when%20the%20publisher%20was%20configured%20on%20PyPI.
If that's insufficient to debug, feel free to connect with me to further diagnose.

[nateprewitt]

Thanks @miketheman! We'll take a closer look at it when I'm back. This was the first run of the publisher and I don't think we tested it against PyPI before it got merged.