hashin: Requirements.txt Hashing Tool

1.0.5 · active · verified Fri Apr 17

hashin is a command-line tool that automates the process of adding hashes (e.g., SHA256) to entries in a `requirements.txt` file, improving supply chain security by ensuring integrity. It is currently at version 1.0.5 and maintains an active release cadence, with recent updates focusing on Python version compatibility and internal dependency management.

Common errors

```
hashin: command not found
```
cause `hashin` is not installed or its installation directory is not in your system's PATH.

fix Ensure `hashin` is installed by running `pip install hashin`. If it is installed, verify your system's PATH configuration or try running it via `python -m hashin`.
```
ERROR: Command "hashin" requires Python >=3.9
```
cause You are attempting to run `hashin` using a Python interpreter version older than 3.9.

fix Switch to a Python 3.9+ environment (e.g., using `pyenv` or `conda`), or upgrade your default Python interpreter. For example, `python3.9 -m pip install hashin`.
```
ERROR: No requirements file found at 'requirements.txt'
```
cause `hashin` was run without specifying a requirements file, and no file named `requirements.txt` exists in the current working directory.

fix Either create a `requirements.txt` file in your current directory, or specify the path to your requirements file using the `-r` option: `hashin -r path/to/my_requirements.txt`.

Warnings

breaking hashin 1.0.1 and later versions require Python 3.9 or newer. Older Python versions (e.g., 3.8) are no longer supported due to internal dependency updates.
Fix: Upgrade your Python environment to 3.9 or higher. If you must use an older Python version, pin `hashin<1.0.1` at your own risk, as it may have other compatibility issues or unpatched bugs.
gotcha `hashin` modifies your `requirements.txt` file in-place. This is its intended behavior, but users should be aware of it and ideally run `hashin` within a version-controlled repository to easily revert changes if necessary.
Fix: Always commit your `requirements.txt` file before running `hashin`, or ensure you have backups. You can also review the changes with `git diff` after running `hashin`.
gotcha hashin requires a valid requirements file format. If package versions are malformed or unresolvable by pip, `hashin` may fail or produce unexpected results.
Fix: Ensure your `requirements.txt` entries are correctly formatted (e.g., `package==version`) and that the specified versions are available on PyPI or your configured package index. Use `pip install -r requirements.txt --dry-run` to test resolvability without installing.

Install

pip install hashin Install hashin

Quickstart

This quickstart demonstrates how to use `hashin` from the command line. It creates a temporary `requirements.txt` file, runs `hashin` to add hashes, and then prints the updated content. `hashin` modifies the file in-place.

import subprocess
import os

# Create a dummy requirements.txt for demonstration
requirements_content = """
requests==2.31.0
click==8.1.7
"""
with open("requirements.txt", "w") as f:
    f.write(requirements_content)

print("Original requirements.txt:")
with open("requirements.txt", "r") as f:
    print(f.read())

try:
    # Run hashin to add hashes to requirements.txt in place
    # Using -r requirements.txt explicitly for clarity, though it's the default.
    print("\nRunning: hashin -r requirements.txt\n")
    result = subprocess.run(["hashin", "-r", "requirements.txt"], capture_output=True, text=True, check=True)
    print("hashin output:")
    print(result.stdout)
    if result.stderr:
        print("hashin stderr (if any):\n" + result.stderr)

    print("\nUpdated requirements.txt:")
    with open("requirements.txt", "r") as f:
        print(f.read())

except subprocess.CalledProcessError as e:
    print(f"Error running hashin: {e.stderr}")
except FileNotFoundError:
    print("Error: 'hashin' command not found. Please ensure it's installed and in your PATH.")
finally:
    # Clean up the dummy file
    if os.path.exists("requirements.txt"):
        os.remove("requirements.txt")

view raw JSON →