{
  "id": "python/pip-requirements-unsupported-hash",
  "signature": "ERROR: Hash mismatch for package-1.0.tar.gz\nExpected sha256: abc...\nActual sha256: xyz...",
  "signature_zh": "错误：package-1.0.tar.gz 的哈希值不匹配\n预期 sha256：abc...\n实际 sha256：xyz...",
  "regex": "ERROR:\\ Hash\\ mismatch\\ for\\ package\\-1\\.0\\.tar\\.gz\\\nExpected\\ sha256:\\ abc\\.\\.\\.\\\nActual\\ sha256:\\ xyz\\.\\.\\.",
  "domain": "python",
  "category": "data_error",
  "subcategory": null,
  "root_cause": "The downloaded package's hash does not match the one specified in requirements.txt, indicating corruption or tampering.",
  "root_cause_type": "generic",
  "root_cause_zh": "下载的包哈希值与 requirements.txt 中指定的不匹配，表明文件损坏或被篡改。",
  "versions": [
    {
      "version": "3.8",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "3.9",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "3.10",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Re-running pip with --no-cache-dir",
      "why_fails": "This forces a fresh download, but if the source is compromised, the new download will also have a different hash.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "Manually updating the hash in requirements.txt to match the downloaded file",
      "why_fails": "This bypasses security checks and may install a malicious package.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Verify the package source and re-download from a trusted index",
      "success_rate": 0.85,
      "how": "`pip install --no-cache-dir --index-url https://pypi.org/simple/ package`",
      "condition": "",
      "sources": []
    },
    {
      "action": "Remove the hash from requirements.txt and reinstall",
      "success_rate": 0.8,
      "how": "Edit requirements.txt to remove the --hash=sha256:... entry, then run `pip install -r requirements.txt`",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": null,
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.82,
  "fix_success_rate": 0.8,
  "resolvable": "true",
  "first_seen": "2024-08-20",
  "last_confirmed": "2025-01-01",
  "last_updated": "2025-01-01",
  "evidence_count": 0,
  "tags": [],
  "locale": "en",
  "aliases": []
}