# 错误：package-1.0.tar.gz 的哈希值不匹配
预期 sha256：abc...
实际 sha256：xyz...

- **ID:** `python/pip-requirements-unsupported-hash`
- **领域:** python
- **类别:** data_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

下载的包哈希值与 requirements.txt 中指定的不匹配，表明文件损坏或被篡改。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.8 | active | — | — |
| 3.9 | active | — | — |
| 3.10 | active | — | — |

## 解决方案

1. **Verify the package source and re-download from a trusted index** (85% 成功率)
   ```
   `pip install --no-cache-dir --index-url https://pypi.org/simple/ package`
   ```
2. **Remove the hash from requirements.txt and reinstall** (80% 成功率)
   ```
   Edit requirements.txt to remove the --hash=sha256:... entry, then run `pip install -r requirements.txt`
   ```

## 无效尝试

- **Re-running pip with --no-cache-dir** — This forces a fresh download, but if the source is compromised, the new download will also have a different hash. (50% 失败率)
- **Manually updating the hash in requirements.txt to match the downloaded file** — This bypasses security checks and may install a malicious package. (90% 失败率)