When should the content-hash update?

[fwindolf]

I'm using 1.5.1 and I can run a poetry update ... to update my dependency. This will result in the version bumped in poetry.lock, but no update of the content-hash. If I run a poetry add ...@latest the version changes.

I can't seem to find this behaviour explained in the docs, and as I build containers with lots of heavy ML libraries in CI/CD, I try to avoid downloading + installing if not necessary. This is done by checking the content-hash, as I understood it as a "hash of the content".

Either it's not, or there is a bug and the content hash update is forgotten on poetry update.

[radoering]

The purpose of the content hash is to check if the lockfile is consistent with the pyproject.toml, i.e. the relevant parts of the pyproject.toml have not been changed since the lockfile was created. That's why the content hash is built from relevant parts of the pyproject.toml. When you run poetry update only the lockfile is changed and that's why the content hash does not change.

That's probably not explained because it's considered internals.

[vivodi]

content-hash means the hash of pyproject.toml instead of poetry.lock.

[tkfoss]

I found this thread when trying to generate content-hash while updating poetry lock by hand. I created a small script for that here https://gist.github.com/tkfoss/823358ba8ff2d5d4dbc1c741279b5daf
Might be useful to someone ✌

[Secrus]

You shouldn't be updating the lock file by hand

[tkfoss]

🏴‍☠️

[Secrus]

Care to share what use case makes you edit lock file manually?

[tkfoss]

I haven't managed to set up poetry with gemfury, so now I install all the packages I can from the source with pip, and let poetry install fail on them. I have to ask someone else to recreate lock when updating dependency package, so I update the lock by hand. Thank you for asking!

for reference this works on the pipeline but for some reason doesn't work on my machines (mac and debian pc)

poetry --no-ansi config repositories.bigBiz https://pypi.fury.io/bigBiz 
poetry --no-ansi config http-basic.bigBiz $GEMFURY_TOKEN $GEMFURY_TOKEN