python data_error ai_generated true

ERROR: Hash mismatch for package-1.0.tar.gz Expected sha256: abc... Actual sha256: xyz...

ID: python/pip-requirements-unsupported-hash

Also available as: JSON · Markdown · 中文
80%Fix Rate
82%Confidence
0Evidence
2024-08-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.8 active — — —
3.9 active — — —
3.10 active — — —

Root Cause

The downloaded package's hash does not match the one specified in requirements.txt, indicating corruption or tampering.

generic

中文

下载的包哈希值与 requirements.txt 中指定的不匹配，表明文件损坏或被篡改。

Workarounds

  1. 85% success Verify the package source and re-download from a trusted index 
    `pip install --no-cache-dir --index-url https://pypi.org/simple/ package`
  2. 80% success Remove the hash from requirements.txt and reinstall 
    Edit requirements.txt to remove the --hash=sha256:... entry, then run `pip install -r requirements.txt`

Dead Ends

Common approaches that don't work:

  1. Re-running pip with --no-cache-dir 50% fail

    This forces a fresh download, but if the source is compromised, the new download will also have a different hash.

  2. Manually updating the hash in requirements.txt to match the downloaded file 90% fail

    This bypasses security checks and may install a malicious package.