python-poetry/poetry · error · PackageNotFoundError

Could not determine a hash for any distribution link of pack

Error message

Could not determine a hash for any distribution link of package: "{data.name}" version: "{data.version}"

What it means

Raised after link filtering when none of the candidate files yielded a usable hash (http_repository.py:469-495). Poetry requires a content hash for every file it locks; if a link carries no sha512/sha384/sha256 digest AND the on-the-fly sha256 calculation (calculate_sha256) returns None (e.g. download failed, FIPS-mode restriction, or hash mismatch), the file is skipped and this error fires when no file remains.

Source

Thrown at src/poetry/repositories/http_repository.py:492

                self._log(
                    f"Failed to determine hash of {link.url}. Skipping file.",
                    level="warning",
                )
            else:
                files.append(
                    {
                        "file": link.filename,
                        "hash": file_hash,
                        "url": link.url_without_fragment,
                    }
                )
                if link.size is not None:
                    files[-1]["size"] = link.size
                if link.upload_time_isoformat is not None:
                    files[-1]["upload_time"] = link.upload_time_isoformat

        if not files:
            raise PackageNotFoundError(
                f'Could not determine a hash for any distribution link of package: "{data.name}" version:'
                f' "{data.version}"'
            )

        data.files = files

        # drop yanked files unless the entire release is yanked
        info = self._get_info_from_links(links, ignore_yanked=not data.yanked)

        data.summary = info.summary
        data.requires_dist = info.requires_dist
        data.requires_python = info.requires_python

        return data.asdict()

    def calculate_sha256(self, link: Link) -> str | None:
        with self._cached_or_downloaded_file(link) as filepath:
            hash_name = get_highest_priority_hash_type(link.hashes, link.filename)

View on GitHub (pinned to 92b74dcfe3)

Solutions

Ensure the index publishes sha256 (preferred) or sha384/sha512 digests for every file.
Check network connectivity and re-run — a transient download corruption can make calculate_sha256 return None.
If running under FIPS, configure the index to use sha256 digests instead of md5/sha1.
Verify the file on the index is not corrupt by downloading it manually and comparing its checksum.

Defensive patterns

Strategy: validation

Validate before calling

# Before relying on a release, confirm its files carry a digest
for link in repository.find_links_for_package(pkg):
    if not any(h in link.hashes for h in ("sha256", "sha384", "sha512")):
        log.warning("%s has no standard digest; hash resolution may fail", link.filename)

Try / catch

from poetry.repositories.exceptions import PackageNotFoundError
try:
    data = repository.package(name, version)
except PackageNotFoundError as e:
    if "Could not determine a hash" in str(e):
        log.error("index missing digests for %s==%s", name, version)
    raise

Prevention

Configure private indexes to publish sha256 digests for every file.
Avoid FIPS-disabling md5/sha1-only indexes; prefer sha256.
Validate downloaded files independently when operating on untrusted indexes.

When it happens

Trigger: repository.package() against an index that lists files without any standard digest, while the fallback download for sha256 computation fails or the recomputed known-hash does not match link.hashes (cache.py calculate_sha256 returning None at the mismatch branch). Also triggered in FIPS-enabled environments where the declared hash algorithm is unavailable.

Common situations: A private/legacy repository that does not publish sha256 digests; a corrupted download whose recomputed hash disagrees with the index; FIPS mode disabling md5/sha1 such that the known-hash check fails.

Related errors

AI-assisted analysis of python-poetry/poetry@92b74dcfe3 (2026-08-04). Data as JSON: /data/errors/9bb46b9086faa44d.json. Report an issue: GitHub.