# ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes.
    Expected sha256 3f7a...
         Got        a91c...

- **ID:** `python/pip-hash-mismatch-downloaded-wheel`
- **Domain:** python
- **Category:** install_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

A `--hash` pin in requirements.txt does not match the hash of the downloaded artifact. Causes: package was re-uploaded, hash was computed on a different wheel (platform tag), or the artifact was tampered with.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| pip>=21.0 | active | — | — |

## Workarounds

1. **** (90% success)
   ```
   Regenerate hashes for the exact artifacts you intend to install:

pip download --no-deps --dest /tmp/wheels <pkg>==<ver>
pip hash /tmp/wheels/<pkg>-<ver>-*.whl

Update requirements.txt with the new sha256.
   ```
2. **** (85% success)
   ```
   Use pip-tools to keep hashes in sync automatically:

pip install pip-tools
pip-compile --generate-hashes requirements.in
pip-sync requirements.txt
   ```

## Dead Ends

- **** — pip still enforces --hash pins; --no-deps and --ignore-installed do not bypass hash verification. (90% fail)
- **** — Removes supply-chain protection and defeats the purpose of the pinned hash; acceptable only as a temporary local debug step. (40% fail)