python install_error ai_generated true

错误：这些包与需求文件中的哈希值不匹配。如果您更新了包版本，请更新哈希值。

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes.

ID: python/pip-hash-mismatch-requirements

其他格式: JSON · Markdown 中文 · English
80%修复率
87%置信度
0证据数
2024-06-19首次发现

版本兼容性

版本状态引入弃用备注
3.x active — — —

根因分析

下载产物的 SHA256 与 requirements.txt 中固定的 --hash 值不匹配，表明哈希过期或产物被篡改/替换。

English

The downloaded artifact's SHA256 does not match the --hash value pinned in requirements.txt, indicating a stale hash or tampered/alternate artifact.

generic

解决方案

  1. 95% 成功率 
    pip-compile --generate-hashes requirements.in
  2. 90% 成功率 
    pip download pkg==1.2.3 -d /tmp/dl
python -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" /tmp/dl/*.whl

无效尝试

常见但无效的做法:

  1. 90% 失败

    --no-deps does not disable hash verification; pip still validates hashes.

  2. 60% 失败

    Removing hashes defeats the purpose and may violate policy; also breaks reproducible installs.

  3. 85% 失败

    Trusted-host only affects TLS verification, not artifact hash verification.