python install_error ai_generated true

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them. mypkg==1.0.0 from https://files.pythonhosted.org/.../mypkg-1.0.0-py3-none-any.whl#sha256=abcd...: Expected sha256 0000... Got abcd...

ID: python/pip-hash-mismatch-requirements

Also available as: JSON · Markdown · 中文
80%Fix Rate
87%Confidence
0Evidence
2024-11-02First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

A requirements.txt with --hash=sha256:... entries contains a hash that does not match the downloaded artifact, either because the file was re-uploaded or the hash was mistyped.

generic

中文

带有 --hash=sha256:... 条目的 requirements.txt 包含与下载产物不匹配的哈希值，可能是因为文件被重新上传或哈希值输入错误。

Workarounds

  1. 96% success 
    Run pip-compile --generate-hashes requirements.in -o requirements.txt, then pip install --require-hashes -r requirements.txt.
  2. 90% success 
    Run pip download mypkg==1.0.0 --no-deps -d /tmp/dl then sha256sum /tmp/dl/mypkg-1.0.0-py3-none-any.whl and paste the result into requirements.txt.

Dead Ends

Common approaches that don't work:

  1. 90% fail

    The hashes are embedded in requirements.txt; the flag is implied.

  2. 92% fail

    Trusted-host only affects TLS verification, not hash verification.

  3. 88% fail

    Hash checks apply to the top-level package too.