IMHO do not mix both. Keep sha256 as a partial function, like the md5. This will work on the download-file-a-like handler.
The mime-type can be keep here (keeping an additional read), or moved…
ah ok, you use the loop for this, imho it is ok to move it out
Do not remove the sha256, can be used during the download call (without storing the file). Note that you reimplemented it later with a similiar for
eventually factory and devel should go out of the Git class
I am not sure that I like the first commit, where the the pool is dropped if there is only one package. If debug is the problem, we should improve the logs.
Same? Is there any transaction open?
Is not closing the cursor with doing the commit?
Making max_workers to None will create one process per CPU. That is OK in my desktop, but laptop report like 32 of them, and I am sure this will kill OBS. Maybe create a parameter with some low default?