Fiona 1.8.8 was modified after being uploaded to PyPi

[jrheard]

This is kind of a meta-issue so please excuse my diverging from the issue template.

My organization uses pipenv to manage our python dependencies. Pipenv uses a Pipfile.lock file that pins versions of a library to a particular hash. Our Pipfile.lock was updated somewhere in the past few days, shortly after Fiona version 1.8.8 was released.

This morning, when running pipenv install in CI, we saw this output:

Installing dependencies from Pipfile.lock (2b77e7)…
An error occurred while installing fiona==1.8.8 --hash=sha256:0a41b995b708336ed0481ec4a9693ff362767065974e5ba392fb16792f36906c --hash=sha256:356a5087abfca62041cf8e730287042f956b7fbff42776eeeecfa64bc0028977 --hash=sha256:711c3be73203b37812992089445a1e4e9d3d6b64e667389f7b15406e15a91e83 --hash=sha256:87b0433ecf5345ec60c604c62671825e79a0d0afa74e722032349f5408fb0d1e --hash=sha256:a1523e696b6ef03d62023be832642bbc8a3c9e0fe67527dfc0229faa88b4aee3 --hash=sha256:a9f4c935ad039ceb25cce9e54950f3bdd5d82cd5a36fec24141cee594da612d7 --hash=sha256:c22656a09c453a9d0ff96f1d29256136c2f6897388a441fd129d3e2903678dbf --hash=sha256:de7c653a0d84d40e83ed77c5f27feaf48348a0d8d7358e53c1794fe7fb1bcdae --hash=sha256:e59559498fe7b28de41afd07b9e22f4a229323d6c35794656673d40950ce0cf3! Will try again.
Installing initially failed dependencies…
[pipenv.exceptions.InstallError]:   File "/usr/local/lib/python3.7/site-packages/pipenv/core.py", line 1874, in do_install
[pipenv.exceptions.InstallError]:       keep_outdated=keep_outdated
[pipenv.exceptions.InstallError]:   File "/usr/local/lib/python3.7/site-packages/pipenv/core.py", line 1253, in do_init
[pipenv.exceptions.InstallError]:       pypi_mirror=pypi_mirror,
[pipenv.exceptions.InstallError]:   File "/usr/local/lib/python3.7/site-packages/pipenv/core.py", line 859, in do_install_dependencies
[pipenv.exceptions.InstallError]:       retry_list, procs, failed_deps_queue, requirements_dir, **install_kwargs
[pipenv.exceptions.InstallError]:   File "/usr/local/lib/python3.7/site-packages/pipenv/core.py", line 763, in batch_install
[pipenv.exceptions.InstallError]:       _cleanup_procs(procs, not blocking, failed_deps_queue, retry=retry)
[pipenv.exceptions.InstallError]:   File "/usr/local/lib/python3.7/site-packages/pipenv/core.py", line 681, in _cleanup_procs
[pipenv.exceptions.InstallError]:       raise exceptions.InstallError(c.dep.name, extra=err_lines)
[pipenv.exceptions.InstallError]: ['Collecting fiona==1.8.8 (from -r /tmp/pipenv-uqfyhxqg-requirements/pipenv-xcsmnjrt-requirement.txt (line 1))', '  Using cached https://files.pythonhosted.org/packages/70/49/b9ee1f53e5b8eaf312ed7134bb3ac947a9997f71ec84ef966598ee4bc6fd/Fiona-1.8.8-1-cp37-cp37m-manylinux1_x86_64.whl']
[pipenv.exceptions.InstallError]: ['ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.', '    fiona==1.8.8 from https://files.pythonhosted.org/packages/70/49/b9ee1f53e5b8eaf312ed7134bb3ac947a9997f71ec84ef966598ee4bc6fd/Fiona-1.8.8-1-cp37-cp37m-manylinux1_x86_64.whl#sha256=8431aa3d790c5b509c4532ddb9a783df34d02a4e7b3175e5e75d058c09f81a90 (from -r /tmp/pipenv-uqfyhxqg-requirements/pipenv-xcsmnjrt-requirement.txt (line 1)):', '        Expected sha256 0a41b995b708336ed0481ec4a9693ff362767065974e5ba392fb16792f36906c', '        Expected     or 356a5087abfca62041cf8e730287042f956b7fbff42776eeeecfa64bc0028977', '        Expected     or 711c3be73203b37812992089445a1e4e9d3d6b64e667389f7b15406e15a91e83', '        Expected     or 87b0433ecf5345ec60c604c62671825e79a0d0afa74e722032349f5408fb0d1e', '        Expected     or a1523e696b6ef03d62023be832642bbc8a3c9e0fe67527dfc0229faa88b4aee3', '        Expected     or a9f4c935ad039ceb25cce9e54950f3bdd5d82cd5a36fec24141cee594da612d7', '        Expected     or c22656a09c453a9d0ff96f1d29256136c2f6897388a441fd129d3e2903678dbf', '        Expected     or de7c653a0d84d40e83ed77c5f27feaf48348a0d8d7358e53c1794fe7fb1bcdae', '        Expected     or e59559498fe7b28de41afd07b9e22f4a229323d6c35794656673d40950ce0cf3', '             Got        8431aa3d790c5b509c4532ddb9a783df34d02a4e7b3175e5e75d058c09f81a90']

Looking at https://pypi.org/project/Fiona/1.8.8/#files , it looks like version 1.8.8 was replaced with a version 1.8.8-1 after being released. I'm sure there was a good reason for this, and recovering from the situation is very easy for us, I just wanted to let you know that this (briefly) affected us and wanted to put this output somewhere on the Internet so that other affected people might be able to find it in search engines. I'm going to close this issue because I don't believe any action is required, just wanted to send along this heads-up!

[jrheard]

My coworkers suggested that I reopen this so that we can explicitly double-check that this 1.8.8-1 version was intentional / known :)

[kannes]

It was intentional: https://fiona.groups.io/g/main/topic/1_8_8_1_update_for_fiona/34306923?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,0,34306923

[sgillies]

@jrheard thanks for pointing this out! I can see how pipenv would flag this. I'll make sure to continue posting on the Fiona discussion group and here in the repo (#796) if I need to do this again.