pip DO NOT MATCH THE HASHES no known caching

Question

Any package I try to install using python 2/3 will fail on hash comparison eg

/opt/homebrew/opt/[email protected]/bin/python3  -m pip install --upgrade pip
Requirement already satisfied: pip in /opt/homebrew/lib/python3.10/site-packages (22.0.2)
Collecting pip
  Downloading pip-22.0.4-py3-none-any.whl
     \ 523.2 kB 7.1 MB/s 0:00:00
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE.

same python different package

Installing with pip..
Collecting pynvim
  Downloading pynvim-0.4.3.tar.gz
     / 523 kB 5.2 MB/s
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE.

have tried:

• rm -rf ~/.cache/pip/
• brew uninstall python // and reinstall
• .. --no-cache-dir ..
• manually downloading a .whl file (failing: ERROR: Wheel 'pip' located at {location}/pip-22.0.4-py3-none-any.whl is invalid.
• not seeing any local cache that pip could use

worth noting, I started with SSL cert issues from files.pythonhosted - it seems they don't have a valid cert on files domain, so I've added this pip.conf which brought me to the subsequent hashes error:

cat ~/.config/pip/pip.conf
[global]
trusted-host = pypi.python.org
           pypi.org
           files.pythonhosted.org

tried easy_install.py - failing on same SSL cert issues tried get-pip.py - failing on hashes issues on both python2 and python 3 eg

/usr/bin/python get-pip2.py
DEPRECATION: Python 2.7 ...
Defaulting to user installation because normal site-packages is not writeable
Collecting pip<21.0
  Downloading pip-20.3.4-py2.py3-none-any.whl
     / 523 kB 4.3 MB/s
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE.

I'm out of ideas and cannot find anything relevant online, anyone have any suggestions? Thanks!

Answer 1

Turns out that my Internet provider was blocking files.pythonhosted due to the insecure self signed ssl certificate.

The hash was the same for every pip package - the reason was I was getting a my provider was redirecting me "blocking content" html error page, which in turn caused pips hash validation security check to fail.