python data_error ai_generated true

错误：package-1.0.tar.gz 的哈希值不匹配 预期 sha256：abc... 实际 sha256：xyz...

ERROR: Hash mismatch for package-1.0.tar.gz Expected sha256: abc... Actual sha256: xyz...

ID: python/pip-requirements-unsupported-hash

其他格式: JSON · Markdown 中文 · English
80%修复率
82%置信度
0证据数
2024-08-20首次发现

版本兼容性

版本状态引入弃用备注
3.8 active — — —
3.9 active — — —
3.10 active — — —

根因分析

下载的包哈希值与 requirements.txt 中指定的不匹配，表明文件损坏或被篡改。

English

The downloaded package's hash does not match the one specified in requirements.txt, indicating corruption or tampering.

generic

解决方案

  1. 85% 成功率 Verify the package source and re-download from a trusted index 
    `pip install --no-cache-dir --index-url https://pypi.org/simple/ package`
  2. 80% 成功率 Remove the hash from requirements.txt and reinstall 
    Edit requirements.txt to remove the --hash=sha256:... entry, then run `pip install -r requirements.txt`

无效尝试

常见但无效的做法:

  1. Re-running pip with --no-cache-dir 50% 失败

    This forces a fresh download, but if the source is compromised, the new download will also have a different hash.

  2. Manually updating the hash in requirements.txt to match the downloaded file 90% 失败

    This bypasses security checks and may install a malicious package.