python-poetry/poetry · error · RuntimeError

Hash for {package} from archive {archive.name} not found in

Error message

Hash for {package} from archive {archive.name} not found in known hashes (was: {archive_hash})

What it means

Raised by Executor._validate_archive_hash at src/poetry/installation/executor.py:806-812 when the computed hash of the downloaded/cached archive (hash_type:get_file_hash(...)) is not in the set of known hashes recorded for that file in package.files. This is the core integrity check failing — the bytes Poetry fetched do not match the lock. RuntimeError.

Source

Thrown at src/poetry/installation/executor.py:809

            archive_hash = self._validate_archive_hash(archive, package)
            self._hashes[package.name] = archive_hash

    @staticmethod
    def _validate_archive_hash(archive: Path, package: Package) -> str:
        known_hashes = {f["hash"] for f in package.files if f["file"] == archive.name}
        hash_types = {t.split(":")[0] for t in known_hashes}
        hash_type = get_highest_priority_hash_type(hash_types, archive.name)

        if hash_type is None:
            raise RuntimeError(
                f"No usable hash type(s) for {package} from archive"
                f" {archive.name} found (known hashes: {known_hashes!s})"
            )

        archive_hash = f"{hash_type}:{get_file_hash(archive, hash_type)}"

        if archive_hash not in known_hashes:
            raise RuntimeError(
                f"Hash for {package} from archive {archive.name} not found in"
                f" known hashes (was: {archive_hash})"
            )

        return archive_hash

    def _download_archive(
        self,
        operation: Install | Update,
        url: str,
        dest: Path,
    ) -> None:
        downloader = Downloader(
            url, dest, self._authenticator, max_retries=self._max_retries
        )
        wheel_size = downloader.total_size

        operation_message = self.get_operation_message(operation)

View on GitHub (pinned to 92b74dcfe3)

Solutions

Clear Poetry's cache for the package: `poetry cache clear --all <CACHE_NAME>` (list via `poetry cache list`).
Re-download with caching disabled: `poetry install --no-cache`.
If the lock is stale relative to the upstream artifacts, regenerate: `poetry lock --no-cache --regenerate`.
If the hash mismatch persists, investigate whether a corporate proxy/mirror is rewriting artifacts.

Example fix

# before
$ poetry install
RuntimeError: Hash for pkg ... not found in known hashes (was: sha256:deadbeef...)

# after
$ poetry cache clear --all pypi:cache
$ poetry install --no-cache

Defensive patterns

Strategy: retry

Try / catch

try:
    executor.run(operations)
except RuntimeError as e:
    if 'not found in known hashes' in str(e):
        run('poetry', 'cache', 'clear', '--all', cache_name, check=False)
        executor.run(operations)  # one retry with a fresh download
    raise

Prevention

Treat hash mismatches as integrity failures — investigate before retrying.
Use trusted indexes; avoid proxies that rewrite package bytes.
Keep caches modest in size to reduce stale-entry risk.

When it happens

Trigger: During install, for a package whose archive.name is listed in package.files, the actual bytes on disk hash to a value not present among the locked hashes. Triggered from _populate_hashes_dict → _validate_archive_hash.

Common situations: Corrupted download (network blip, truncated file), a poisoned HTTP cache, a mirror serving tampered artifacts, or a lock file from a different distribution of the same version.

Related errors

AI-assisted analysis of python-poetry/poetry@92b74dcfe3 (2026-08-04). Data as JSON: /data/errors/32d45b3caf151acc.json. Report an issue: GitHub.