Skip to content

Checksum validation failing when fetching missing python #1652

@thmahe

Description

@thmahe

Describe the bug

pipx is unable to validate archives from https://github.com/astral-sh/python-build-standalone since 20250708 release.

Note from python-build-standalone release

Remove .sha256 files: these artifacts are no longer published to GitHub Releases; unfortunately, they put us above the newly enforced 1000 file limit for GitHub Release artifacts. A single SHA256SUMS file with all of the checksums is still published.

How to reproduce

$ pipx install xxx --global --python 3.11 --fetch-missing-python
pipx >(setup:1110): pipx version is 1.7.1
pipx >(setup:1111): Default python interpreter is '/usr/bin/python3.13'
pipx >(find_unix_command_python:74): Command `python3.11` was not found on the system
Traceback (most recent call last):
  File "/usr/local/bin/pipx", line 8, in <module>
    sys.exit(cli())
             ~~~^^
  File "/usr/local/lib/python3.13/dist-packages/pipx/main.py", line 1176, in cli
    return run_pipx_command(parsed_pipx_args, subparsers)
  File "/usr/local/lib/python3.13/dist-packages/pipx/main.py", line 252, in run_pipx_command
    interpreter = find_python_interpreter(
        args.python or DEFAULT_PYTHON, fetch_missing_python=fetch_missing_python
    )
  File "/usr/local/lib/python3.13/dist-packages/pipx/interpreter.py", line 104, in find_python_interpreter
    return download_python_build_standalone(python_version)
  File "/usr/local/lib/python3.13/dist-packages/pipx/standalone_python.py", line 84, in download_python_build_standalone
    _unpack(full_version, download_link, archive, download_dir)
    ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/dist-packages/pipx/standalone_python.py", line 115, in _unpack
    expected_checksum = urlopen(checksum_link).read().decode().rstrip("\n")
                        ~~~~~~~^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/urllib/request.py", line 189, in urlopen
    return opener.open(url, data, timeout)
           ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/urllib/request.py", line 495, in open
    response = meth(req, response)
  File "/usr/lib/python3.13/urllib/request.py", line 604, in http_response
    response = self.parent.error(
        'http', request, response, code, msg, hdrs)
  File "/usr/lib/python3.13/urllib/request.py", line 533, in error
    return self._call_chain(*args)
           ~~~~~~~~~~~~~~~~^^^^^^^
  File "/usr/lib/python3.13/urllib/request.py", line 466, in _call_chain
    result = func(*args)
  File "/usr/lib/python3.13/urllib/request.py", line 613, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 404: Not Found

Expected behavior

pipx must validate hash from SHA256SUMS file distributed by python-build-standalone.
https://github.com/astral-sh/python-build-standalone/releases/download/20250712/SHA256SUMS

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions