{"action":"opened","issue":{"url":"https://api.github.com/repos/pypa/pip/issues/4930","repository_url":"https://api.github.com/repos/pypa/pip","labels_url":"https://api.github.com/repos/pypa/pip/issues/4930/labels{/name}","comments_url":"https://api.github.com/repos/pypa/pip/issues/4930/comments","events_url":"https://api.github.com/repos/pypa/pip/issues/4930/events","html_url":"https://github.com/pypa/pip/issues/4930","id":282869143,"number":4930,"title":"Package download interrupted then pip reports invalid md5 hash","user":{"login":"tomzo","id":5710970,"avatar_url":"https://avatars0.githubusercontent.com/u/5710970?v=4","gravatar_id":"","url":"https://api.github.com/users/tomzo","html_url":"https://github.com/tomzo","followers_url":"https://api.github.com/users/tomzo/followers","following_url":"https://api.github.com/users/tomzo/following{/other_user}","gists_url":"https://api.github.com/users/tomzo/gists{/gist_id}","starred_url":"https://api.github.com/users/tomzo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomzo/subscriptions","organizations_url":"https://api.github.com/users/tomzo/orgs","repos_url":"https://api.github.com/users/tomzo/repos","events_url":"https://api.github.com/users/tomzo/events{/privacy}","received_events_url":"https://api.github.com/users/tomzo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-12-18T12:52:38Z","updated_at":"2017-12-18T12:52:38Z","closed_at":null,"author_association":"NONE","body":"* Pip version: 9.0.1\r\n* Python version: tried on 2.7 and 3.5\r\n* Operating system: Linux\r\n* Devpi-server: 4.3.0\r\n\r\n### Description:\r\n\r\nI am running devpi-server as cache of public packages, because I have slow internet connection. Which works fine except for `pandas` package which is unusually big `20M-24M`. When server cache is empty (download is slow) the **download is interrupted** at about 85%-95%. But then **pip does not report timeout error**, but instead computes hash of downloaded part and reports md5 hash mismatch.\r\nI am not sure if this is caused by pip timeout or some bug in devpi.\r\n\r\n### What I've run:\r\n\r\nWhen server cache is cold, I can reproduce the error by running pip install or download.\r\nNotice that it gets interrupted at different moment in time:\r\n```\r\npip3 download pandas==0.20.3\r\nCollecting pandas==0.20.3\r\n  Downloading http://devpi.ai-traders.com/root/pypi/+f/a0f/df9f6d772ed81/pandas-0.20.3-cp35-cp35m-manylinux1_x86_64.whl (24.0MB)\r\n    89% |############################    | 21.5MB 43.7MB/s eta 0:00:01\r\nTHESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.\r\n    pandas==0.20.3 from http://devpi.ai-traders.com/root/pypi/+f/a0f/df9f6d772ed81/pandas-0.20.3-cp35-cp35m-manylinux1_x86_64.whl#md5=a0fdf9f6d772ed8168ec6ce555ac7aba:\r\n        Expected md5 a0fdf9f6d772ed8168ec6ce555ac7aba\r\n             Got        d01f88a8b5728ce6cc6648762056c379\r\n```\r\n\r\n```\r\npip download pandas==0.20.3\r\nCollecting pandas==0.20.3\r\n  Downloading http://devpi.ai-traders.com/root/pypi/+f/a0f/df9f6d772ed81/pandas-0.20.3-cp35-cp35m-manylinux1_x86_64.whl (24.0MB)\r\n    92% |#############################   | 22.2MB 26.4MB/s eta 0:00:01\r\nTHESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.\r\n    pandas==0.20.3 from http://devpi.ai-traders.com/root/pypi/+f/a0f/df9f6d772ed81/pandas-0.20.3-cp35-cp35m-manylinux1_x86_64.whl#md5=a0fdf9f6d772ed8168ec6ce555ac7aba:\r\n        Expected md5 a0fdf9f6d772ed8168ec6ce555ac7aba\r\n             Got        885ebdc266f92e3a580c93082b4f5a84\r\n```\r\n\r\nInstall fails too:\r\n```\r\npip3 install pandas==0.20.3\r\nCollecting pandas==0.20.3\r\n  Downloading http://devpi.ai-traders.com/root/pypi/+f/a0f/df9f6d772ed81/pandas-0.20.3-cp35-cp35m-manylinux1_x86_64.whl (24.0MB)\r\n    82% |##########################      | 19.9MB 47.2MB/s eta 0:00:01\r\nTHESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.\r\n    pandas==0.20.3 from http://devpi.ai-traders.com/root/pypi/+f/a0f/df9f6d772ed81/pandas-0.20.3-cp35-cp35m-manylinux1_x86_64.whl#md5=a0fdf9f6d772ed8168ec6ce555ac7aba:\r\n        Expected md5 a0fdf9f6d772ed8168ec6ce555ac7aba\r\n             Got        55784939b2225b3653c4cecf13ac0fc5\r\n```\r\n\r\nThen I can run download with higher timeout and it will pass:\r\n```\r\npip download pandas==0.21.1 --timeout 180\r\nCollecting pandas==0.21.1\r\n  Downloading http://devpi.ai-traders.com/root/pypi/+f/664/ee5e5a3af1850/pandas-0.21.1-cp35-cp35m-manylinux1_x86_64.whl (25.7MB)\r\n    100% |################################| 25.7MB 48kB/s \r\n  Saved ./pandas-0.21.1-cp35-cp35m-manylinux1_x86_64.whl\r\nCollecting python-dateutil>=2 (from pandas==0.21.1)\r\n  File was already downloaded /ide/work/python_dateutil-2.6.1-py2.py3-none-any.whl\r\nCollecting numpy>=1.9.0 (from pandas==0.21.1)\r\n  File was already downloaded /ide/work/numpy-1.13.3-cp35-cp35m-manylinux1_x86_64.whl\r\nCollecting pytz>=2011k (from pandas==0.21.1)\r\n  File was already downloaded /ide/work/pytz-2017.3-py2.py3-none-any.whl\r\nCollecting six>=1.5 (from python-dateutil>=2->pandas==0.21.1)\r\n  File was already downloaded /ide/work/six-1.11.0-py2.py3-none-any.whl\r\nSuccessfully downloaded pandas python-dateutil numpy pytz six\r\n```\r\n\r\nBut, strangely, running install with higher timeout fails:\r\n```\r\npip install pandas==0.21.1 --timeout 180\r\nCollecting pandas==0.21.1\r\n  Downloading http://devpi.ai-traders.com/root/pypi/+f/664/ee5e5a3af1850/pandas-0.21.1-cp35-cp35m-manylinux1_x86_64.whl (25.7MB)\r\n    32% |##########                      | 8.5MB 61.0MB/s eta 0:00:01\r\nTHESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.\r\n    pandas==0.21.1 from http://devpi.ai-traders.com/root/pypi/+f/664/ee5e5a3af1850/pandas-0.21.1-cp35-cp35m-manylinux1_x86_64.whl#md5=664ee5e5a3af1850ce715ba6b7ededf7:\r\n        Expected md5 664ee5e5a3af1850ce715ba6b7ededf7\r\n             Got        d6d0fbd859cafe420e992405858bf81c\r\n```\r\n\r\nThen when server cache was populated I can run pip install with success.\r\nI tested all above multiple times and I can reproduce it consistently."}}
{"actor":{"display_login":"tomzo"}}