{"categories":[{"label":"Build Tools","url":"https://skillfed.io/packages/category/software-development-build-tools/4"},{"label":"Systems Administration","url":"https://skillfed.io/packages/category/system-systems-administration"},{"label":"Installation/Setup","url":"https://skillfed.io/packages/category/system-installation-setup"}],"enrichment":{"capability":"Automates the process of adding cryptographic hashes to your requirements.txt file, enabling reproducible and verified package installations with pip's hash-checking mode.","skillfed_tags":["dependency-management","reproducible-builds","security-hardening"],"use_cases":["Lock exact package versions and hashes in a development environment, then deploy those same hashes to production servers for reproducible installs.","Add a new dependency to your requirements.txt with verified hashes without manually downloading and hashing each distribution file.","Filter package hashes by Python version when a package offers wheels for multiple Python versions you don't all support.","Preview changes to requirements.txt before committing them using --dry-run mode.","Integrate hash-locked requirements into a deployment workflow where pip install --require-hashes enforces that only pre-vetted packages are installed."],"what_it_does":"hashin is a command-line tool that automates the tedious process of generating SHA256 (or other algorithm) hashes for Python packages and writing them into your requirements.txt file in a format compatible with pip's --require-hashes flag. Instead of manually downloading each package, running pip hash on each file, and editing requirements.txt, you run hashin with a package name or version specifier and it handles all those steps.\n\nThe tool downloads packages from PyPI over HTTPS, computes their hashes, and updates your requirements file with the hash-locked entries. It supports filtering by Python version (useful when a package has wheels for multiple Python versions), dry-run mode to preview changes, environment markers, and can be used both as a CLI tool and as a Python library. The underlying philosophy is that you vet the downloaded packages yourself (using the --verbose flag to inspect download locations) before committing the hashes, then deploy those hash-locked requirements to servers with confidence that the exact same packages will be installed.","worth_installing":"Yes. hashin solves a real operational problem\u2014automating hash generation for reproducible, verified package installations\u2014with low install friction, active maintenance, no security vulnerabilities, and a permissive license. It is most valuable in deployment workflows where you want to enforce that production servers install only the exact packages you have vetted, but it requires discipline: you must manually inspect the downloaded files (via --verbose) to ensure they haven't been tampered with before committing the hashes."},"id":"hashin","links":{"html":"https://skillfed.io/packages/hashin","md":"https://skillfed.io/packages/hashin.md","pypi":"https://pypi.org/project/hashin/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2025-06-12","license_spdx":null,"license_treatment":"permissive","name":"hashin","python_support":"supports_current","summary":"Edits your requirements.txt by hashing them in"},"popularity":{"monthly_downloads":142940,"position":11194,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.5"}