PEP 710: Require at leat one hash to be stated (#3879)

Signed-off-by: Fridolin Pokorny <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

Author: fridex

peps/pep-0710.rst

@@ -146,11 +146,11 @@ used to download the given distribution package, such as
 compliant with :pep:`503`.
 
 The value of ``archive_info`` MUST be a dictionary with a single key
-``hashes``.  The value of ``hashes`` is a dictionary mapping hash function names to a
-hex-encoded digest of the file referenced by the ``url`` value. Multiple hashes
-can be included, and it is up to the consumer to decide what to do with
-multiple hashes (it may validate all of them or a subset of them, or nothing at
-all).
+``hashes``.  The value of ``hashes`` is a dictionary mapping hash function
+names to a hex-encoded digest of the file referenced by the ``url`` value. At
+least one hash MUST be recorded. Multiple hashes MAY be included, and it is up
+to the consumer to decide what to do with multiple hashes (it may validate all
+of them or a subset of them, or nothing at all).
 
 Each hash MUST be one of the single argument hashes provided by
 :data:`py3.11:hashlib.algorithms_guaranteed`, excluding ``sha1`` and ``md5`` which MUST NOT be used.
@@ -341,6 +341,17 @@ in the Python docs under :attr:`py3.11:hashlib.hash.name`.
     "url": "https://files.pythonhosted.org/packages/07/51/2c0959c5adf988c44d9e1e0d940f5b074516ecc87e96b1af25f59de9ba38/pip-23.0.1-py3-none-any.whl"
   }
 
+The last example demonstrates a ``provenance_url.json`` file with no hashes
+available for the downloaded artifact:
+
+.. code-block:: json
+
+  {
+    "archive_info": {
+      "hashes": {}
+     }
+    "url": "https://files.pythonhosted.org/packages/07/51/2c0959c5adf988c44d9e1e0d940f5b074516ecc87e96b1af25f59de9ba38/pip-23.0.1-py3-none-any.whl"
+  }
 
 Example pip commands and their effect on provenance_url.json and direct_url.json
 --------------------------------------------------------------------------------
@@ -424,6 +435,18 @@ By doing so we eliminate possible redundancy in the file, possible confusion,
 and any additional checks that would need to be done to make sure the hashes are in
 sync.
 
+Allowing no hashes stated
+-------------------------
+
+For cases when a wheel file is installed from pip's cache and built using an
+older version of pip, pip does not record hashes of the downloaded source
+distributions. As we do not have hashes of these downloaded source
+distributions, the ``hashes`` key in the ``provenance_url.json`` file would not
+contain any entries. In such cases, pip does not create any
+``provenance_url.json`` file as the provenance information is not complete. It
+is encouraged for consumers to rebuild wheels with a newer version of pip in
+these cases.
+
 Making the hashes key optional
 ------------------------------