# 错误：这些包与 requirements 文件中的哈希不匹配。如果已更新包版本，请更新哈希值。

- **ID:** `python/pip-hash-mismatch-downloaded-wheel`
- **领域:** python
- **类别:** install_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

requirements.txt 中的 `--hash` 固定值与下载产物的哈希不匹配。原因：包被重新上传、哈希基于不同 wheel（平台标签）计算，或产物被篡改。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| pip>=21.0 | active | — | — |

## 解决方案

1. **** (90% 成功率)
   ```
   Regenerate hashes for the exact artifacts you intend to install:

pip download --no-deps --dest /tmp/wheels <pkg>==<ver>
pip hash /tmp/wheels/<pkg>-<ver>-*.whl

Update requirements.txt with the new sha256.
   ```
2. **** (85% 成功率)
   ```
   Use pip-tools to keep hashes in sync automatically:

pip install pip-tools
pip-compile --generate-hashes requirements.in
pip-sync requirements.txt
   ```

## 无效尝试

- **** — pip still enforces --hash pins; --no-deps and --ignore-installed do not bypass hash verification. (90% 失败率)
- **** — Removes supply-chain protection and defeats the purpose of the pinned hash; acceptable only as a temporary local debug step. (40% 失败率)