pypa/pip · error · VcsHashUnsupported

Can't verify hashes for these requirements because we don't

Error message

Can't verify hashes for these requirements because we don't have a way to hash version control repositories:

What it means

Raised as VcsHashUnsupported when --require-hashes is active and a requirement is backed by a version-control URL (git+, hg+, svn+, bzr+). At prepare.py:473-474, _get_linked_req_hashes checks req.link.is_vcs and aborts because there is no single, stable file to hash for a VCS checkout.

Source

Thrown at src/pip/_internal/operations/prepare.py:474

            parallel_builds=parallel_builds,
        )
        req.ensure_pristine_source_checkout()

    def _get_linked_req_hashes(self, req: InstallRequirement) -> Hashes:
        # By the time this is called, the requirement's link should have
        # been checked so we can tell what kind of requirements req is
        # and raise some more informative errors than otherwise.
        # (For example, we can raise VcsHashUnsupported for a VCS URL
        # rather than HashMissing.)
        if not self.require_hashes:
            return req.hashes(trust_internet=True)

        # We could check these first 2 conditions inside unpack_url
        # and save repetition of conditions, but then we would
        # report less-useful error messages for unhashable
        # requirements, complaining that there's no hash provided.
        if req.link.is_vcs:
            raise VcsHashUnsupported()
        if req.link.is_existing_dir():
            raise DirectoryUrlHashUnsupported()

        # Unpinned packages are asking for trouble when a new version
        # is uploaded.  This isn't a security check, but it saves users
        # a surprising hash mismatch in the future.
        # file:/// URLs aren't pinnable, so don't complain about them
        # not being pinned.
        if not req.is_direct and not req.is_pinned:
            raise HashUnpinned()

        # If known-good hashes are missing for this requirement,
        # shim it with a facade object that will provoke hash
        # computation and then raise a HashMissing exception
        # showing the user what the hash should be.
        return req.hashes(trust_internet=False) or MissingHashes()

    def _fetch_metadata_only(

View on GitHub (pinned to d7d0d0a394)

Solutions

1. Replace the VCS requirement with a pinned sdist/wheel URL that includes a sha256 hash.
2. Build a wheel from the VCS checkout once and reference that wheel (with its hash) in the requirements file.
3. Drop --require-hashes for that environment if VCS requirements are truly required (reduces reproducibility guarantees).
4. Vendor the dependency into the repo and install it as a local directory after pinning a known revision.

Example fix

# before (requirements.txt with --require-hashes)
git+https://github.com/org/repo.git@abc123#egg=pkg

# after: build wheel, pin by hash
pkg @ https://my-mirror/pkg-1.0-py3-none-any.whl \
  --hash=sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

def validate_no_vcs_under_require_hashes(requirements_file):
    with open(requirements_file) as f:
        for line in f:
            line = line.strip()
            if line and not line.startswith("#") and "+" in line.split(":")[0]:
                scheme = line.split("+", 1)[0]
                if scheme in ("git", "hg", "svn", "bzr"):
                    raise SystemExit(f"VCS requirement cannot be hashed: {line}")

def is_vcs_url(url: str) -> bool:
    return any(url.startswith(p) for p in ("git+", "hg+", "svn+", "bzr+"))

When it happens

Trigger: Running pip install --require-hashes with a requirements file that contains a VCS requirement such as 'git+https://github.com/org/repo.git@abc123#egg=pkg'. Hash verification has no reproducible artifact to checksum, so pip refuses.

Common situations: Pinning a repo in a hashed lockfile. Mixing development VCS checkouts into a hashed, reproducible build. CI enforcing --require-hashes but a dependency pulls a git URL.

Related errors

• The editable requirement {req} cannot be installed when requ
• Can't verify hashes for these file:// requirements because t
• In --require-hashes mode, all requirements must have their v
• Unknown hash name: {hash_name}
• THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/c891aa1a416ec578.json. Report an issue: GitHub.