{"id":"edcb5d7952625a5a","repo":"pypa/pip","slug":"require-hashes-and-no-require-hashes-are-mutua","errorCode":null,"errorMessage":"--require-hashes and --no-require-hashes are mutually exclusive","messagePattern":"--require-hashes and --no-require-hashes are mutually exclusive","errorType":"exception","errorClass":"CommandError","httpStatus":null,"severity":"error","filePath":"src/pip/_internal/cli/req_command.py","lineNumber":431,"sourceCode":"                if not check_requires_python(\n                    requires_python=script_requires_python,\n                    version_info=target_python.py_version_info,\n                ):\n                    raise UnsupportedPythonVersion(\n                        f\"Script {script!r} requires a different Python: \"\n                        f\"{target_python.py_version} not in {script_requires_python!r}\"\n                    )\n\n            for req in script_metadata.get(\"dependencies\", []):\n                req_to_add = install_req_from_req_string(\n                    req,\n                    isolated=options.isolated_mode,\n                    user_supplied=True,\n                )\n                requirements.append(req_to_add)\n\n        if options.require_hashes and options.no_require_hashes:\n            raise CommandError(\n                \"--require-hashes and --no-require-hashes are mutually exclusive\"\n            )\n\n        # If any requirement has hash options, enable hash checking for all\n        # requirements, unless this mechanism has been explicitly disabled\n        # with --no-require-hashes.\n        if not options.no_require_hashes and any(\n            req.has_hash_options for req in requirements\n        ):\n            options.require_hashes = True\n\n        if not (\n            args\n            or options.editables\n            or options.requirements\n            or options.dependency_groups\n            or options.requirements_from_scripts\n        ):","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_internal/cli/req_command.py#L413-L449","documentation":"Raised by pip's RequirementCommand when both --require-hashes and --no-require-hashes are passed on the same invocation. These flags are logical opposites: --require-hashes forces hash-checking on every requirement, --no-require-hashes disables the auto-detection that turns on hash-checking when a requirement carries hash options. pip refuses to guess which one wins, so it aborts in build_package_finder/run flow via a CommandError.","triggerScenarios":"Invoking pip install/download/wheel with both --require-hashes and --no-require-hashes on the command line, in PIP_INSTALL_OPTS env var, in a requirements file's pip options, or in a pip.conf. The check at req_command.py:430 fires unconditionally before any resolution.","commonSituations":"Copy-pasting flags from two different runbooks; a wrapper script (tox, nox, CI YAML) concatenating a 'secure' hash-pinning block with a legacy --no-require-hashes block; requirements files that inherit each other via -r; setting PIP_REQUIRE_HASHES=1 in the environment while a config file also sets no-require-hashes.","solutions":["Inspect the full pip invocation: run with pip <cmd> -vv to see option sources, then remove either --require-hashes or --no-require-hashes.","Check pip.conf (pip config list), PIP_* environment variables, and any -r requirements files for one of the two flags and delete the conflicting one.","If you need hashes, keep --require-hashes only; if you must disable hash auto-detection, keep --no-require-hashes only.","If a wrapper script assembles flags, split the secure and legacy flag sets into mutually exclusive code paths instead of unioning them."],"exampleFix":"// before\npip install --require-hashes --no-require-hashes -r locked.txt\n// after\npip install --require-hashes -r locked.txt","handlingStrategy":"validation","validationCode":"# Validate flag exclusivity before shelling out to pip\nflags = {\"--require-hashes\": require_hashes, \"--no-require-hashes\": no_require_hashes}\nif all(flags.values()):\n    raise SystemExit(\"Cannot pass both --require-hashes and --no-require-hashes\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Centralize hash-pinning policy in a single pip.conf or env var instead of command-line flags.","When programmatically building pip argv, assert at most one of the two flags is present before exec."],"tags":["pip","cli","hash-pinning","configuration-conflict"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}