{"id":"bb5e8787fab7ac84","repo":"pypa/pip","slug":"hashes-are-required-in-require-hashes-mode-but","errorCode":null,"errorMessage":"Hashes are required in --require-hashes mode, but they are missing from some requirements. Here is a list of those requirements along with the hashes their downloaded archives actually had. Add lines like these to your requirements files to prevent tampering. (If you did not enable --require-hashes manually, note that it turns on automatically when any package has a hash.)","messagePattern":"Hashes are required in --require-hashes mode, but they are missing from some requirements\\. Here is a list of those requirements along with the hashes their downloaded archives actually had\\. Add lines like these to your requirements files to prevent tampering\\. \\(If you did not enable --require-hashes manually, note that it turns on automatically when any package has a hash\\.\\)","errorType":"exception","errorClass":"HashMissing","httpStatus":null,"severity":"error","filePath":"src/pip/_internal/utils/hashes.py","lineNumber":150,"sourceCode":"        )\n\n\nclass MissingHashes(Hashes):\n    \"\"\"A workalike for Hashes used when we're missing a hash for a requirement\n\n    It computes the actual hash of the requirement and raises a HashMissing\n    exception showing it to the user.\n\n    \"\"\"\n\n    def __init__(self) -> None:\n        \"\"\"Don't offer the ``hashes`` kwarg.\"\"\"\n        # Pass our favorite hash in to generate a \"gotten hash\". With the\n        # empty list, it will never match, so an error will always raise.\n        super().__init__(hashes={FAVORITE_HASH: []})\n\n    def _raise(self, gots: dict[str, _Hash]) -> NoReturn:\n        raise HashMissing(gots[FAVORITE_HASH].hexdigest())\n","sourceCodeStart":132,"sourceCodeEnd":151,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_internal/utils/hashes.py#L132-L151","documentation":"HashMissing raised by MissingHashes._raise() (the --require-hashes path) when a requirement has no --hash line at all. In require-hashes mode every requirement must carry a known-good hash; pip computes the archive's real hash and prints it so the user can paste it in.","triggerScenarios":"MissingHashes is used when a requirement lacks hashes while --require-hashes is active (or it auto-activated because another requirement had a hash). After download, check_against_chunks finds the FAVORITE_HASH list empty and calls _raise → HashMissing with the computed sha256.","commonSituations":"Turning on --require-hashes (or adding one hashed package) in a project where most requirements have no hashes; adding a new dependency without running pip-compile; CI enforcing hashes on a freshly-edited requirements file.","solutions":["Copy the `--hash=sha256:...` line pip prints for each missing requirement into your requirements file.","Regenerate the whole file with `pip-compile --generate-hashes` to get consistent hashes for everything.","Make sure every requirement is pinned with == (require-hashes also demands version pinning; see HashUnpinned)."],"exampleFix":"# before\n--require-hashes\npkg==1.0          # no hash → HashMissing\nother==2.0 --hash=sha256:...\n\n# after - add the hash pip printed\npkg==1.0 --hash=sha256:<the hash pip computed and showed>","handlingStrategy":"validation","validationCode":"def every_req_has_hash(reqs_txt):\n    missing = []\n    for line in parse_requirements(reqs_txt):\n        if line.is_requirement and '--hash=' not in line.raw:\n            missing.append(line.name)\n    return missing\n# require-hashes mode: assert this returns [] before running pip","typeGuard":null,"tryCatchPattern":"try:\n    pip_install('--require-hashes', '-r', 'reqs.txt')\nexcept HashMissing as e:\n    # e.body() prints the computed hash to paste in\n    add_printed_hashes('reqs.txt', e)\n    pip_install('--require-hashes', '-r', 'reqs.txt')","preventionTips":["Use `pip-compile --generate-hashes` to produce fully-hashed lockfiles.","Ensure every requirement is pinned with == (require-hashes also forbids unpinned).","Re-run the hasher whenever you add or bump a dependency."],"tags":["pip","hashes","require-hashes","security","lockfile"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}