Turn --verify-hashes on by default

[hauntsaninja]

Fixes #9164

Using clap's default_value_t makes the flag function unhappy, so just set the default when we unwrap. Tested with no flags, --verify-hashes, --no-verify-hashes and setting in uv.toml

[hauntsaninja]

I don't understand what's causing these two new lines

[hauntsaninja]

Note that UV_VERIFY_HASHES=0 won't really do anything because flag will receive false, false and turn it into None -> true, so we'll continue to verify hashes. We need something that does the opposite of BoolishValueParser

[charliermarsh]

What if we change HashCheckingMode::from_args to take two Option? Then we can differentiate between UV_VERIFY_HASHES being 0, 1, or unset.

It would also be somewhat conventional for us to make --verify-hashes hidden, and add UV_NO_VERIFY_HASHES.

[hauntsaninja]

I assume you meant flag, not HashCheckingMode::from_args. Right now it's too late by then, since clap will already have given you bools. The naive thing of turning verify_hashes into an Option<bool> in the CLI struct seemed to mess with clap's logic for flags and setting default_missing_value didn't seem to fix. I'm probably missing some dumb clap trick, feel free to take over this PR if it's obvious to you!

[charliermarsh]

Sounds good, I'll see what I can do...

[hauntsaninja]

Okay, the issue is that default_missing_value just silently doesn't work if you don't also specify require_equals and num_args. I'll push the change (if you see a better way feel free to)!

[charliermarsh]

Okay I modified things a bit such that instead of UV_VERIFY_HASHES=0, we require UV_NO_VERIFY_HASHES=1, which is consistent with the rest of the CLI. We also now document --no-verify-hashes instead of --verify-hashes.

[hauntsaninja]

Need to change the string constant here

[hauntsaninja]

#9186

[charliermarsh]

Hah, great... Thanks!