summershum
A fedmsg consumer that extracts and stores hashes of source files.
summershum is composed of two components:
A fedmsg consumer plugin that listens for org.fedoraproject.prod.git.lookaside.new messages. Whenever a contributor uploads a new source tarball to the lookaside cache, summershum will download that tarball, unpack it, and calculate the sha1 sum of every file in the tarball. Those hashes are then stored in a database to be queried later.
A cli tool summershum-cli that queries datagrepper for the fedmsg history. It then crawls through old lookaside messages to fill in data where it was missed.
With the summershum database, we can then make some interesting queries in short time:
how many files have this hash sum in all of fedora? and for which packages ?
we can easily find what is bundling what and generate a programatic list
we could check the db in taskotron tests
we could check to see how many packages include the full GPL license
how many packages have that license but with the old FSF address
Release files for summershum 0.1.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| summershum-0.1.5.tar.gz | 18.6 kB | Without provenance | Details for summershum-0.1.5.tar.gz |
Release files / summershum-0.1.5.tar.gz
| Download URL | summershum-0.1.5.tar.gz |
|---|---|
| Size | 18.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a154e765b0288bb8fe678fb366abfcadba2ab48126ea452921d014cfb0bdbff3
|
|
BLAKE2b-256 checksum How to use checksums |
0c3f5a0587dab6718dd13088168d0ff513cbd32008c88c7d2d7e4aae001b367b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for summershum 0.1.5
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
