feat: Check all hash types when validating archives

[neersighted]

This allows for much-improved compatibility when interfacing with legacy
PyPI-compatible repositories.

This is a successor PR to #4486, and closes #4578 and #4085.
This PR is also a forward-port of #4529.

[sdispater]

I think we can implement it similarly to what is present in 1.1 (see #4529).

To be honest, I forgot to port it to the master branch when fixing it in the 1.1 branch.

[neersighted]

I think we can implement it similarly to what is present in 1.1 (see #4529).

To be honest, I forgot to port it to the master branch when fixing it in the 1.1 branch.

Didn't even see that! I'll port that version to master and push it to this PR in a bit.

[haf]

What's the status of this?

Poetry 1.1.11 fails with

'Link' object has no attribute 'name'

1.1.12 fails with:

Package operations: 34 installs, 0 updates, 0 removals

  • Installing fonttools (4.29.1): Failed

  RuntimeError

  Invalid hashes (sha256:9f14340a5d9b83844a568fd5df480b4a9c915d98803e750094b810b16653a4a7) for fonttools (4.29.1) using archive fonttools-4.29.1-py3-none-any.whl. Expected one of sha256:1933415e0fbdf068815cb1baaa1f159e17830215f7e8624e5731122761627557, sha256:2b18a172120e32128a80efee04cff487d5d140fe7d817deb648b2eee023a40e4.

[neersighted]

Closing this as not a complete design/unable to be merged in its present form.

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.