{"id":"7f37f36845a64453","repo":"pypa/pip","slug":"unknown-hash-name-hash-name","errorCode":null,"errorMessage":"Unknown hash name: {hash_name}","messagePattern":"Unknown hash name: (.+?)","errorType":"exception","errorClass":"InstallationError","httpStatus":null,"severity":"error","filePath":"src/pip/_internal/utils/hashes.py","lineNumber":81,"sourceCode":"        return sum(len(digests) for digests in self._allowed.values())\n\n    def is_hash_allowed(self, hash_name: str, hex_digest: str) -> bool:\n        \"\"\"Return whether the given hex digest is allowed.\"\"\"\n        return hex_digest in self._allowed.get(hash_name, [])\n\n    def check_against_chunks(self, chunks: Iterable[bytes]) -> None:\n        \"\"\"Check good hashes against ones built from iterable of chunks of\n        data.\n\n        Raise HashMismatch if none match.\n\n        \"\"\"\n        gots = {}\n        for hash_name in self._allowed.keys():\n            try:\n                gots[hash_name] = hashlib.new(hash_name)\n            except (ValueError, TypeError):\n                raise InstallationError(f\"Unknown hash name: {hash_name}\")\n\n        for chunk in chunks:\n            for hash in gots.values():\n                hash.update(chunk)\n\n        for hash_name, got in gots.items():\n            if got.hexdigest() in self._allowed[hash_name]:\n                return\n        self._raise(gots)\n\n    def _raise(self, gots: dict[str, _Hash]) -> NoReturn:\n        raise HashMismatch(self._allowed, gots)\n\n    def check_against_file(self, file: BinaryIO) -> None:\n        \"\"\"Check good hashes against a file-like object\n\n        Raise HashMismatch if none match.\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_internal/utils/hashes.py#L63-L99","documentation":"InstallationError raised in Hashes.check_against_chunks when hashlib.new(hash_name) throws ValueError/TypeError — the hash algorithm name supplied via --hash (or in a requirements file) is not recognized by hashlib. Only names in STRONG_HASHES (sha256/sha384/sha512) are intended, but any hashlib-unknown string triggers this at verify time.","triggerScenarios":"self._allowed contains a key that hashlib.new() rejects. E.g. a requirements line `pkg --hash=md5:...` or `--hash=sha1:...`, or a typo like `--hash=SHA256:...` handled case-sensitively, or a junk algorithm name.","commonSituations":"Copying hashes from an old lockfile that used md5/sha1; an external tool (pip-tools/pip-compile older version) emitting a weak algorithm; a hand-typed algorithm name typo; a requirements fragment produced by a non-pip hasher.","solutions":["Regenerate hashes with `pip hash` or pip-compile using sha256 (the FAVORITE_HASH).","Replace md5/sha1 hashes with sha256 hashes of the same archives.","Fix typos/casing in the algorithm name (use lowercase sha256/sha384/sha512)."],"exampleFix":"# before\npkg==1.0 --hash=md5:abcdef...\n\n# after\npkg==1.0 --hash=sha256:$(curl -sL https://files/pythonhosted.org/.../pkg-1.0.tar.gz | sha256sum | cut -d' ' -f1)","handlingStrategy":"validation","validationCode":"import hashlib\n\nALLOWED = {'sha256', 'sha384', 'sha512'}\n\ndef validate_hash_names(req_hashes):\n    for alg in req_hashes:\n        if alg not in ALLOWED:\n            try:\n                hashlib.new(alg)\n            except (ValueError, TypeError) as e:\n                raise ValueError(f\"unsupported/typo hash algorithm {alg!r}: {e}\")\n# run over a requirements file's --hash keys before installing","typeGuard":null,"tryCatchPattern":"try:\n    pip_install('-r', 'reqs.txt')\nexcept InstallationError as e:\n    if 'Unknown hash name' in str(e):\n        normalize_hash_algorithms('reqs.txt')  # rewrite md5/sha1 → sha256\n        pip_install('-r', 'reqs.txt')\n    else:\n        raise","preventionTips":["Use only sha256/sha384/sha512 in --hash lines.","Generate hashes with `pip hash` or pip-compile so names are always valid.","Watch for case/typos when copying hashes between files."],"tags":["pip","hashes","hashlib","require-hashes","security"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}