hashibuild
Content hash for a source subtree of a git repo, with optional hash-keyed build caching.
The hash covers the git-tracked files of the subtree (git ls-files) plus the lock and toolchain
files from its parent directories (Cargo.lock, package-lock.json, pnpm-lock.yaml, go.sum, ...),
so it changes whenever anything that affects the built result changes.
pip install hashibuild # or: uvx hashibuild, cargo install --path .
hashibuild path/to/component # print the hash
hashibuild path/to/component -m # per-file manifest + total
hashibuild -c app.json --build # build with caching
Hashing
| Option | Meaning |
|---|---|
--only PREFIX, --exclude PREFIX |
case-insensitive prefix filters on subtree-relative paths (only first, then exclude) |
-i PATHSPEC |
extra repo-relative files to include |
-n NAME |
extra file name to look for in parent dirs |
--no-defaults |
skip the built-in lock file list |
--untracked |
also hash untracked, non-ignored files |
--salt, --build-param |
mixed into the hash |
-l, -m, -s N |
list files, manifest, short hash |
Build caching
--build looks for <archive>/<name>_<hash>.zip; on a hit it unzips into the output root, otherwise it
runs buildCmd, zips the output dirs and runs the uploader.
{
"name": "myapp",
"inputRoot": "../myapp",
"outputDir": "dist",
"buildCmd": "npm run build",
"exclude": ["tests/"]
}
| Variable | Meaning |
|---|---|
HASHIBUILD_ARCHIVE |
local archive dir (or --archive) |
HASHIBUILD_FETCHER |
command run on a local miss, e.g. aws s3 cp s3://bucket/[ZIP] [DEST] |
HASHIBUILD_UPLOADER |
command run after a build, e.g. aws s3 cp [ZIP] s3://bucket/ |
Release
Publishing a GitHub release tagged vX.Y.Z builds binaries and wheels and publishes to PyPI
(Trusted Publishing, environment pypi).
1 maintainer
Metadata
1 maintainer
Release files for hashibuild 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Actions Reset | |||
|---|---|---|---|---|
| hashibuild-0.1.0-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details for hashibuild-0.1.0-py3-none-win_amd64.whl |
| hashibuild-0.1.0-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl | Python 3 | none | Linux glibc 2.17+ x86-64 | Details for hashibuild-0.1.0-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl |
| hashibuild-0.1.0-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details for hashibuild-0.1.0-py3-none-macosx_11_0_arm64.whl |
| hashibuild-0.1.0-py3-none-macosx_10_12_x86_64.whl | Python 3 | none | macOS 10.12+ x86-64 | Details for hashibuild-0.1.0-py3-none-macosx_10_12_x86_64.whl |
Total release size: 3.2 MB
Release files / hashibuild-0.1.0-py3-none-win_amd64.whl
| Download URL | hashibuild-0.1.0-py3-none-win_amd64.whl |
|---|---|
| Size | 701.8 kB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
4f870d2319dde385d302a63b1fee25cb3ac3851e2f29d7c94025d52c2a863bb4
|
|
BLAKE2b-256 checksum How to use checksums |
4a007b5c0b52b3b2d8e42cca1ed23ed9dbabd8de4c97d4b2fd276b0889c16935
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 1, 2026.
Transparency logRelease files / hashibuild-0.1.0-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl
| Download URL | hashibuild-0.1.0-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl |
|---|---|
| Size | 886.2 kB |
| Tags | Linux glibc 2.17+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
3a4b2b9c06237d76d7ef7149e7b53600f63e6524ca9d55bb4ce26228b344a192
|
|
BLAKE2b-256 checksum How to use checksums |
03e7117745e67582640b9ee5777ef15712c92c3accad43c8d0ff57ddd32628a0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 1, 2026.
Transparency logRelease files / hashibuild-0.1.0-py3-none-macosx_11_0_arm64.whl
| Download URL | hashibuild-0.1.0-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 793.5 kB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
daa612949c698c6768f8001dc11e831a2109a94908a80c09311e8df8fda0f456
|
|
BLAKE2b-256 checksum How to use checksums |
61c107a4e2c3a85b644ed74d27865ce28f955e8374c7f12921cd80c4126327d4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 1, 2026.
Transparency logRelease files / hashibuild-0.1.0-py3-none-macosx_10_12_x86_64.whl
| Download URL | hashibuild-0.1.0-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 840.2 kB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
7b525dd6fae8a109e5aafe2853c9c7a7d784bff34eee5fa803903e043b68dc06
|
|
BLAKE2b-256 checksum How to use checksums |
c0ed74643a6269541644185a597ea9a8fc07a9000b6f1b8edac766c744d4df01
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 1, 2026.
Transparency logSecurity for hashibuild 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 4 files in this release have been uploaded with provenance metadata.
Attestation for hashibuild-0.1.0-py3-none-win_amd64.whl
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 1, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
