Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

* correct logger for publisher
* build 0.10.0 to get metadata in PackageInfo
* prefer pathlib
* passwords must be strings

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

The env keyword contains the modified path (that uses get_temp_environ)
so without it, anything using the `input` path here would get the wrong
env.

fixes python-poetry#7623

several versions of a package that does not have
its metada correctly declared.

* fix hash mismatch during installation with `no-binary` option for packages that provide suitable wheels
* do not skip hash check for sdists
* write hash for sdists in direct_url.json

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

drop deprecated `hash` in favor of `hashes`
* https://packaging.python.org/en/latest/specifications/direct-url/ supersedes PEP 610
* keeping `hash` for compatibility probably does not make sense since it was not spec-compliant (":" instead of "=" as separator between algorithm and value)