python-poetry/poetry · error · RuntimeError

No usable hash type(s) for {package} from archive {archive.n

Error message

No usable hash type(s) for {package} from archive {archive.name} found (known hashes: {known_hashes!s})

What it means

Raised by Executor._validate_archive_hash at src/poetry/installation/executor.py:794-804 when the set of hash types recorded for the archive in package.files, passed through get_highest_priority_hash_type, yields no usable type. The archive has a record entry but none of its hash types are in the priority list. RuntimeError.

Source

Thrown at src/poetry/installation/executor.py:801

        # Use the original archive to provide the correct hash.
        self._populate_hashes_dict(original_archive, package)

        return archive

    def _populate_hashes_dict(self, archive: Path, package: Package) -> None:
        if package.files and archive.name in {f["file"] for f in package.files}:
            archive_hash = self._validate_archive_hash(archive, package)
            self._hashes[package.name] = archive_hash

    @staticmethod
    def _validate_archive_hash(archive: Path, package: Package) -> str:
        known_hashes = {f["hash"] for f in package.files if f["file"] == archive.name}
        hash_types = {t.split(":")[0] for t in known_hashes}
        hash_type = get_highest_priority_hash_type(hash_types, archive.name)

        if hash_type is None:
            raise RuntimeError(
                f"No usable hash type(s) for {package} from archive"
                f" {archive.name} found (known hashes: {known_hashes!s})"
            )

        archive_hash = f"{hash_type}:{get_file_hash(archive, hash_type)}"

        if archive_hash not in known_hashes:
            raise RuntimeError(
                f"Hash for {package} from archive {archive.name} not found in"
                f" known hashes (was: {archive_hash})"
            )

        return archive_hash

    def _download_archive(
        self,
        operation: Install | Update,
        url: str,

View on GitHub (pinned to 92b74dcfe3)

Solutions

Regenerate the lock so it records sha256: `poetry lock --no-cache --regenerate`.
Inspect poetry.lock for the package's files block and confirm hash values start with a supported algorithm (sha256 preferred).
If the upstream index only publishes weak hashes, switch to an index that publishes sha256 or accept the limitation by removing the package's files entry (not recommended).

Example fix

# before (poetry.lock)
[[package.files]]
file = "pkg-1.0-py3-none-any.whl"
hash = "md5:abc123..."

# after
$ poetry lock --no-cache --regenerate
# (lock now records sha256:...)

Defensive patterns

Strategy: validation

Validate before calling

from poetry.utils.hashes import get_highest_priority_hash_type

for f in package.files:
    types = {h.split(':')[0] for h in [f['hash']]}
    if get_highest_priority_hash_type(types, f['file']) is None:
        raise ValueError(f"No usable hash type for {f['file']}; regenerate lock with sha256.")

Try / catch

try:
    executor.run(operations)
except RuntimeError as e:
    if 'No usable hash type' in str(e):
        run('poetry', 'lock', '--no-cache', '--regenerate', check=True)
        executor.run(operations)
    raise

Prevention

Generate locks with current Poetry so sha256 is recorded.
Do not hand-edit hash fields in poetry.lock.

When it happens

Trigger: package.files contains entries for archive.name whose 'hash' fields use hash algorithms Poetry does not consider usable (e.g. only 'md5' or an unknown scheme). Encountered during _populate_hashes_dict → _validate_archive_hash at install time.

Common situations: A lock file generated by an old/modified Poetry that recorded only weak hash types; a manually edited lock file; a package source that publishes only md5 hashes; lock file corruption.

Related errors

AI-assisted analysis of python-poetry/poetry@92b74dcfe3 (2026-08-04). Data as JSON: /data/errors/c88a90cf687c5ada.json. Report an issue: GitHub.