# ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes.

- **ID:** `python/pip-hash-mismatch-requirements`
- **Domain:** python
- **Category:** install_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The downloaded artifact's SHA256 does not match the --hash value pinned in requirements.txt, indicating a stale hash or tampered/alternate artifact.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   pip-compile --generate-hashes requirements.in
   ```
2. **** (90% success)
   ```
   pip download pkg==1.2.3 -d /tmp/dl
python -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" /tmp/dl/*.whl
   ```

## Dead Ends

- **** — --no-deps does not disable hash verification; pip still validates hashes. (90% fail)
- **** — Removing hashes defeats the purpose and may violate policy; also breaks reproducible installs. (60% fail)
- **** — Trusted-host only affects TLS verification, not artifact hash verification. (85% fail)