Implied "--require-hashes"?

[helderco]

It's great to have the new --require-hashes option, but can it be implied if installing from a requirements file with hashes?

It's what pip does:

--require-hashes Require a hash to check each requirement against, for repeatable installs. This option is implied when any package in a requirements file has a --hash option.

The reason I need this is because I need to make a container image that installs dependencies from a requirements file, but I don't know if that file will have hashes or not.

[zanieb]

Seems reasonable!

[charliermarsh]

Somewhat interested in finding other designs here, I’m generally not a fan of implied settings.

[helderco]

pip install checks hashes by default if a requirements file contains hashes. You could disable it with --no-require-hashes.

Or introduce an explicit --verify-hashes that checks them if they exist, but otherwise doesn't "require" them.

[helderco]

Hey! 👋 Any update on this? In Dagger, hashes are only checked if uv is disabled explicitly. 😅

[charliermarsh]

I added it in https://github.com/astral-sh/uv/pull/4007.

[hauntsaninja]

I think it's important for the defaults to be secure. Maybe uv could have the proposed --verify-hashes behaviour on by default? ("I have a hash but I expect it to not be checked" seems pretty niche)