[Distutils] strong hashing in RECORD and signed wheel files

[Daniel Holth]

On Jul 18, 2012, at 5:44 PM, PJ Eby <pje at telecommunity.com> wrote:

> On Wed, Jul 18, 2012 at 1:53 PM, Daniel Holth <dholth at gmail.com> wrote:
>> 
>> generate, in the .dist-info directory. This is only meaningful if
>> RECORD has strong hashes, or the installer would have to always
>> rewrite RECORD on install just to include md5 sums to follow the spec.
> 
> If you're including another file anyway, why not just put the
> signatures in there, then?

Of course that would work too. Jarsigner does that. Record is just tantalizingly close to what's needed.