python install_error ai_generated true

错误：这些包与 requirements 文件中的哈希不匹配。如果已更新包版本，请更新哈希值。

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Expected sha256 3f7a... Got a91c...

ID: python/pip-hash-mismatch-downloaded-wheel

其他格式: JSON · Markdown 中文 · English
80%修复率
88%置信度
0证据数
2024-07-22首次发现

版本兼容性

版本状态引入弃用备注
pip>=21.0 active — — —

根因分析

requirements.txt 中的 `--hash` 固定值与下载产物的哈希不匹配。原因：包被重新上传、哈希基于不同 wheel（平台标签）计算，或产物被篡改。

English

A `--hash` pin in requirements.txt does not match the hash of the downloaded artifact. Causes: package was re-uploaded, hash was computed on a different wheel (platform tag), or the artifact was tampered with.

generic

解决方案

  1. 90% 成功率 
    Regenerate hashes for the exact artifacts you intend to install:

pip download --no-deps --dest /tmp/wheels <pkg>==<ver>
pip hash /tmp/wheels/<pkg>-<ver>-*.whl

Update requirements.txt with the new sha256.
  2. 85% 成功率 
    Use pip-tools to keep hashes in sync automatically:

pip install pip-tools
pip-compile --generate-hashes requirements.in
pip-sync requirements.txt

无效尝试

常见但无效的做法:

  1. 90% 失败

    pip still enforces --hash pins; --no-deps and --ignore-installed do not bypass hash verification.

  2. 40% 失败

    Removes supply-chain protection and defeats the purpose of the pinned hash; acceptable only as a temporary local debug step.