pypa/pip · error · HashMissing

Hashes are required in --require-hashes mode, but they are m

Error message

Hashes are required in --require-hashes mode, but they are missing from some requirements. Here is a list of those requirements along with the hashes their downloaded archives actually had. Add lines like these to your requirements files to prevent tampering. (If you did not enable --require-hashes manually, note that it turns on automatically when any package has a hash.)

What it means

HashMissing raised by MissingHashes._raise() (the --require-hashes path) when a requirement has no --hash line at all. In require-hashes mode every requirement must carry a known-good hash; pip computes the archive's real hash and prints it so the user can paste it in.

Source

Thrown at src/pip/_internal/utils/hashes.py:150

        )


class MissingHashes(Hashes):
    """A workalike for Hashes used when we're missing a hash for a requirement

    It computes the actual hash of the requirement and raises a HashMissing
    exception showing it to the user.

    """

    def __init__(self) -> None:
        """Don't offer the ``hashes`` kwarg."""
        # Pass our favorite hash in to generate a "gotten hash". With the
        # empty list, it will never match, so an error will always raise.
        super().__init__(hashes={FAVORITE_HASH: []})

    def _raise(self, gots: dict[str, _Hash]) -> NoReturn:
        raise HashMissing(gots[FAVORITE_HASH].hexdigest())

View on GitHub (pinned to d7d0d0a394)

Solutions

1. Copy the `--hash=sha256:...` line pip prints for each missing requirement into your requirements file.
2. Regenerate the whole file with `pip-compile --generate-hashes` to get consistent hashes for everything.
3. Make sure every requirement is pinned with == (require-hashes also demands version pinning; see HashUnpinned).

Example fix

# before
--require-hashes
pkg==1.0          # no hash → HashMissing
other==2.0 --hash=sha256:...

# after - add the hash pip printed
pkg==1.0 --hash=sha256:<the hash pip computed and showed>

def every_req_has_hash(reqs_txt):
    missing = []
    for line in parse_requirements(reqs_txt):
        if line.is_requirement and '--hash=' not in line.raw:
            missing.append(line.name)
    return missing
# require-hashes mode: assert this returns [] before running pip

try:
    pip_install('--require-hashes', '-r', 'reqs.txt')
except HashMissing as e:
    # e.body() prints the computed hash to paste in
    add_printed_hashes('reqs.txt', e)
    pip_install('--require-hashes', '-r', 'reqs.txt')

When it happens

Trigger: MissingHashes is used when a requirement lacks hashes while --require-hashes is active (or it auto-activated because another requirement had a hash). After download, check_against_chunks finds the FAVORITE_HASH list empty and calls _raise → HashMissing with the computed sha256.

Common situations: Turning on --require-hashes (or adding one hashed package) in a project where most requirements have no hashes; adding a new dependency without running pip-compile; CI enforcing hashes on a freshly-edited requirements file.

Related errors

• Unknown hash name: {hash_name}
• THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS
• Can't verify hashes for these requirements because we don't
• Can't verify hashes for these file:// requirements because t
• In --require-hashes mode, all requirements must have their v

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/bb5e8787fab7ac84.json. Report an issue: GitHub.