错误：这些包与需求文件中的哈希不匹配。如果您已更新包版本，请更新哈希值。否则，请仔细检查包内容；可能有人篡改了它们。 mypkg==1.0.0 来自 https://files.pythonhosted.org/.../mypkg-1.0.0-py3-none-any.whl#sha256=abcd...： 期望 sha256 0000... 实际 abcd...
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them. mypkg==1.0.0 from https://files.pythonhosted.org/.../mypkg-1.0.0-py3-none-any.whl#sha256=abcd...: Expected sha256 0000... Got abcd...
ID: python/pip-hash-mismatch-requirements
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| 3.x | active | — | — | — |
根因分析
带有 --hash=sha256:... 条目的 requirements.txt 包含与下载产物不匹配的哈希值，可能是因为文件被重新上传或哈希值输入错误。
English
A requirements.txt with --hash=sha256:... entries contains a hash that does not match the downloaded artifact, either because the file was re-uploaded or the hash was mistyped.
解决方案
-
96% 成功率
Run pip-compile --generate-hashes requirements.in -o requirements.txt, then pip install --require-hashes -r requirements.txt.
-
90% 成功率
Run pip download mypkg==1.0.0 --no-deps -d /tmp/dl then sha256sum /tmp/dl/mypkg-1.0.0-py3-none-any.whl and paste the result into requirements.txt.
无效尝试
常见但无效的做法:
-
90% 失败
The hashes are embedded in requirements.txt; the flag is implied.
-
92% 失败
Trusted-host only affects TLS verification, not hash verification.
-
88% 失败
Hash checks apply to the top-level package too.