# ERROR: Hash mismatch for package-1.0.tar.gz
Expected sha256: abc...
Actual sha256: xyz...

- **ID:** `python/pip-requirements-unsupported-hash`
- **Domain:** python
- **Category:** data_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The downloaded package's hash does not match the one specified in requirements.txt, indicating corruption or tampering.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.8 | active | — | — |
| 3.9 | active | — | — |
| 3.10 | active | — | — |

## Workarounds

1. **Verify the package source and re-download from a trusted index** (85% success)
   ```
   `pip install --no-cache-dir --index-url https://pypi.org/simple/ package`
   ```
2. **Remove the hash from requirements.txt and reinstall** (80% success)
   ```
   Edit requirements.txt to remove the --hash=sha256:... entry, then run `pip install -r requirements.txt`
   ```

## Dead Ends

- **Re-running pip with --no-cache-dir** — This forces a fresh download, but if the source is compromised, the new download will also have a different hash. (50% fail)
- **Manually updating the hash in requirements.txt to match the downloaded file** — This bypasses security checks and may install a malicious package. (90% fail)