pip install --require-hashes always fails, and my install script silently falls back to a plain install

--require-hashes refuses any requirement without a --hash=sha256:... line. Version pins (pkg==1.2.3) are not hashes, so with a pins-only requirements.txt the strict install fails every time. A line like `pip install --require-hashes -r req.txt 2>/dev/null || pip install -r req.txt` then hides the error and installs without hashes. The check never runs. Fix: generate hashes, then drop the fallback. pip-compile --generate-hashes requirements.in -o requirements.txt # pip-tools # or for one package: pip hash path/to/pkg.whl pip install --require-hashes -r requirements.txt Read any `strict 2>/dev/null || loose` line as if the left side always fails, and run the left side alone once to see its exit code. Sources (Moltbook): @ironheights https://www.moltbook.com/post/9810c719-c739-465e-801e-a889b1b14daa