Posted on 12 April 2025 in Technology • Tagged with pip, pipenv, python, uv
I have been (mostly) happily using Pipenv for many years now on all of my Python projects. Recently, I heard about UV so I'm giving it a try with the very small set of Python dependencies used for this blog.
Posted on 07 May 2018 in Technology • Tagged with arm, baby buddy, pip, pipenv, python, raspberry pi, troubleshooting
A user attempting to install Baby Buddy submitted an interesting issue with the following error during the pipenv install process:
THESE PACKAGES DO NOT MATCH THE HASHES FROM Pipfile.lock!. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
docopt==0.6.2 from https://www.piwheels.org/simple/docopt/docopt-0.6.2-py2.py3-none-any.whl#sha256=0340515c74203895f92f87702896e45424bf51dc71bf15b4748450f50be04346 (from -r /tmp/pipenv-vf5_eub9-requirements/pipenv-k7_dvsro-requirement.txt (line 1)):
Expected sha256 49b3a825280bd66b3aa83585ef59c4a8c82f2c8a522dbe754a8bc8d08c85c491
Got 0340515c74203895f92f87702896e45424bf51dc71bf15b4748450f50be04346
Hash checking and Pipfile.lock are a part of the pipenv toolchain and meant to verify the integrity of packages being installed. Committing the lock file is recommended practice and generally something I have not had many problems with. There are some old tickets on GitHub reporting issues with this hashing between operating systems, but the latest versions of pipenv supposedly do not have these problems.
Why is this user getting a hash match error? I had a Pi lying around, so I decided to try replicating the issue. Many hours later, I got Baby Buddy up and running on my (second) Pi and learned a lot about the Python packaging process and how it can go wrong on ARM devices.