pypa/pip · error · InstallationError

The editable requirement {req} cannot be installed when requ

Error message

The editable requirement {req} cannot be installed when requiring hashes, because there is no single file to hash.

What it means

Raised as InstallationError when an editable requirement (-e) is processed while --require-hashes is active. At prepare.py:850-855, prepare_editable_requirement checks self.require_hashes first and aborts because an editable install has no single file to hash — the source directory is mutable and produces no checksummable artifact.

Source

Thrown at src/pip/_internal/operations/prepare.py:851

        download_location = join_within_directory(self.download_dir, link.filename)
        if not os.path.exists(download_location):
            shutil.copy(req.local_file_path, download_location)
            download_path = display_path(download_location)
            logger.info("Saved %s", download_path)

    def prepare_editable_requirement(
        self,
        req: InstallRequirement,
    ) -> BaseDistribution:
        """Prepare an editable requirement."""
        assert req.editable, "cannot prepare a non-editable req as editable"

        logger.info("Obtaining %s", req)

        with indent_log():
            if self.require_hashes:
                raise InstallationError(
                    f"The editable requirement {req} cannot be installed when "
                    "requiring hashes, because there is no single file to "
                    "hash."
                )
            req.ensure_has_source_dir(self.src_dir)
            req.update_editable()
            assert req.source_dir
            req.download_info = direct_url_for_editable(req.unpacked_source_directory)

            dist = _get_prepared_distribution(
                req,
                self.build_tracker,
                self.build_env_installer,
                self.build_isolation,
                self.check_build_deps,
                self.allow_editables,
            )

View on GitHub (pinned to d7d0d0a394)

Solutions

1. Convert the editable install to a built wheel and pin it by hash: pip wheel . --no-deps -w ./wheels, then reference ./wheels/<pkg>.whl with --hash.
2. Split the environment: install hashed dependencies into the base env, and install the editable package into a separate dev env without --require-hashes.
3. Remove -e and install the package as a normal (non-editable) requirement pinned with a hash.
4. Relax --require-hashes for the editable build if strict hashing is not mandatory.

Example fix

# before
pip install --require-hashes -e .

# after: build a wheel and pin by hash
pip wheel . --no-deps -w ./wheels
pip install --require-hashes \
  ./wheels/mypkg-1.0-py3-none-any.whl \
  --hash=sha256:0123...cdef

def assert_no_editable_under_require_hashes(requirements_lines, require_hashes):
    if not require_hashes:
        return
    bad = [l for l in requirements_lines if l.strip().startswith("-e") or " #egg=" in l and l.startswith("-")]
    if bad:
        raise SystemExit(f"editable requirements incompatible with --require-hashes: {bad}")

def is_editable_req(line: str) -> bool:
    s = line.strip()
    return s.startswith("-e ") or s.startswith("--editable")

When it happens

Trigger: Running 'pip install --require-hashes -e .' or including '-e ./local-pkg' in a hashed requirements file. pip refuses to combine editable installs with mandatory hash verification.

Common situations: Monorepo or local-development workflow where some packages are editable, combined with a CI policy enforcing --require-hashes for reproducibility/security.

Related errors

• Can't verify hashes for these requirements because we don't
• Can't verify hashes for these file:// requirements because t
• In --require-hashes mode, all requirements must have their v
• Unknown hash name: {hash_name}
• THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/c58bbe07b024dbc7.json. Report an issue: GitHub.