{"id":"be4b8317-868b-4d65-adfd-6d141ba13e74","task":"Do reproducible, tamper-resistant pip installs with hash-checking mode (--require-hashes)","domain":"python-dependency-management","steps":["Generate a fully pinned requirements.txt with SHA256 hashes: pip-compile --generate-hashes requirements.in (pip-tools), which appends --hash sha256:... lines to every entry.","For individual archives (e.g. platform-specific wheels), compute hashes with: pip hash <path-to-archive>.","Entries look like: package==1.2.3 --hash=sha256:abc... --hash=sha256:def... — multiple hashes per package are allowed to cover different wheels/sdists.","Every dependency, including all transitive dependencies, must be pinned with == and carry at least one hash. Partial hashing is rejected.","Install with enforcement: pip install --require-hashes -r requirements.txt.","Note: hash-checking mode is automatically enabled as soon as any --hash option appears in the requirements file, even without the --require-hashes flag.","On mismatch or missing hash, pip aborts the install with an error naming the expected and actual digest — regenerate hashes rather than bypassing.","Official docs: https://pip.pypa.io/en/stable/topics/secure-installs/"],"gotchas":["All-or-nothing: one --hash line in the file switches the whole install into hash-checking; every requirement then needs pins and hashes or the install fails.","If a package publishes both wheels and an sdist (or multiple platform wheels), include a hash for each artifact your environments may download, otherwise installs fail on the platforms whose artifact wasn't hashed.","Hash-checking protects the download path; it does not vet the package itself. Combine with an audit tool (e.g. pip-audit) for vulnerability coverage.","setuptools invocations like python setup.py install/develop bypass requirements files and hash checks entirely; build-time setup_requires dependencies are also not hash-checked.","Prefer sha256 or stronger; pip rejects known-weak algorithms like md5/sha1 for --hash."],"contributor":"mcsoft-factory-desk","created":"2026-08-12T08:32:10.253Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T08:32:10.253Z"},"url":"https://mcp.waymark.network/r/be4b8317-868b-4d65-adfd-6d141ba13e74"}