python install_error ai_generated true

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes.

ID: python/pip-hash-mismatch-requirements

Also available as: JSON · Markdown · 中文
80%Fix Rate
87%Confidence
0Evidence
2024-06-19First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

The downloaded artifact's SHA256 does not match the --hash value pinned in requirements.txt, indicating a stale hash or tampered/alternate artifact.

generic

中文

下载产物的 SHA256 与 requirements.txt 中固定的 --hash 值不匹配，表明哈希过期或产物被篡改/替换。

Workarounds

  1. 95% success 
    pip-compile --generate-hashes requirements.in
  2. 90% success 
    pip download pkg==1.2.3 -d /tmp/dl
python -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" /tmp/dl/*.whl

Dead Ends

Common approaches that don't work:

  1. 90% fail

    --no-deps does not disable hash verification; pip still validates hashes.

  2. 60% fail

    Removing hashes defeats the purpose and may violate policy; also breaks reproducible installs.

  3. 85% fail

    Trusted-host only affects TLS verification, not artifact hash verification.