python security_error ai_generated true

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, update the hashes. Otherwise, remove the hashes from the file.

ID: python/pip-hash-mismatch

Also available as: JSON · Markdown · 中文
80%Fix Rate
85%Confidence
0Evidence
2024-11-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.8 active — — —
3.9 active — — —
3.10 active — — —
3.11 active — — —
3.12 active — — —

Root Cause

The downloaded package does not match the expected hash specified in the requirements file, possibly due to corruption or a man-in-the-middle attack.

generic

中文

下载的包与需求文件中指定的预期哈希值不匹配，可能是由于损坏或中间人攻击。

Workarounds

  1. 90% success 
    pip hash package.whl  # generate new hash and replace in file
  2. 80% success 
    PIP_REQUIRE_HASHES=0 pip install package

Dead Ends

Common approaches that don't work:

  1. 20% fail

    This bypasses security checks and may install compromised packages.

  2. 50% fail

    If the source is compromised, re-downloading may fetch the same wrong hashes.