ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE.

[OlegBEZb]

🐛 Describe the bug

I try to build a docker container with a package having a pytorch as a requirement. But for some reason the same stage always fails.

Dockerfile

FROM python:3.11

RUN pip install -r requirements.txt

requirements.txt

sentence-transformers==2.2.1
streamlit==1.21.0
streamlit-chat==0.0.2.2
requests==2.28.2
openai==0.27.6
langchain==0.0.191
tiktoken==0.4.0

I run

docker build . -t "demo"

While collecting torch, I get the following error:

#0 7.771 Collecting torch>=1.6.0 (from sentence-transformers==2.2.1->-r requirements.txt (line 1))
#0 7.830   Downloading torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl (619.9 MB)
#0 10.95      ━━━╸                                    62.4/619.9 MB 18.7 MB/s eta 0:00:30
#0 11.07 ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
#0 11.07     torch>=1.6.0 from https://files.pythonhosted.org/packages/c8/21/25020cfdd9f564a72f400ee491610e50cb212e8add8031abaa959af6451e/torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl (from sentence-transformers==2.2.1->-r requirements.txt (line 1)):
#0 11.07         Expected sha256 e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d
#0 11.07              Got        90e815ec0502ca6c5070e7930f00296ea048a88a225287138e70f21cdcb645a3
------

Versions

PyTorch version: 2.0.1
Is debug build: False
CUDA used to build PyTorch: None
ROCM used to build PyTorch: N/A

OS: macOS 13.4 (x86_64)
GCC version: Could not collect
Clang version: 14.0.3 (clang-1403.0.22.14.1)
CMake version: Could not collect
Libc version: N/A

Python version: 3.11.2 (main, Feb 16 2023, 03:07:35) [Clang 14.0.0 (clang-1400.0.29.202)] (64-bit runtime)
Python platform: macOS-13.4-x86_64-i386-64bit
Is CUDA available: False
CUDA runtime version: No CUDA
CUDA_MODULE_LOADING set to: N/A
GPU models and configuration: No CUDA
Nvidia driver version: No CUDA
cuDNN version: No CUDA
HIP runtime version: N/A
MIOpen runtime version: N/A
Is XNNPACK available: True

CPU:
Intel(R) Core(TM) i7-1068NG7 CPU @ 2.30GHz

Versions of relevant libraries:
[pip3] mypy-extensions==1.0.0
[pip3] numpy==1.25.0
[pip3] torch==2.0.1
[pip3] torchvision==0.15.2
[conda] blas 1.0 mkl
[conda] mkl 2021.2.0 hecd8cb5_269
[conda] mkl-service 2.3.0 py38h9ed2024_1
[conda] mkl_fft 1.3.0 py38h4a7008c_2
[conda] mkl_random 1.2.1 py38hb2f4e1b_2
[conda] numpy 1.18.1 pypi_0 pypi
[conda] numpydoc 1.1.0 pyhd3eb1b0_1
[conda] pytorch-lightning 1.5.8 pypi_0 pypi
[conda] pytorch-tabnet 4.0 pypi_0 pypi
[conda] torch 2.0.1 pypi_0 pypi
[conda] torchmetrics 0.7.2 pypi_0 pypi
[conda] torchvision 0.12.0 pypi_0 pypi

cc @ezyang @gchanan @zou3519 @seemethere @malfet

[ptrblck]

Did your download crash or did you see it finishing?
I've just double checked the wheel in question (torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl) from here and the sha256 matches.
From PyPI:

e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d

Locally after downloading the file via wget:

sha256sum torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl 
e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d  torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl

which also matches the error message:

Expected sha256 e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d

[byt3bl33d3r]

Not exactly sure where the delta is here but i'm having this same issue with the 3.10 wheel using Python and Poetry:

vscode ➜ /workspace (main) $ poetry add sentence-transformers
Using version ^2.2.2 for sentence-transformers

Updating dependencies
Resolving dependencies... Downloading https://files.pythonhosted.org/packages/fa/07/c6980120967a9fc76138eddd583d6ac47dd072922d6f66d7d502f6f9a964/numpy-1.
Resolving dependencies... Downloading https://files.pythonhosted.org/packages/fa/07/c6980120967a9fc76138eddd583d6ac47dd072922d6f66d7d502f6f9a964/numpy-1.
Resolving dependencies... Downloading https://files.pythonhosted.org/packages/fa/07/c6980120967a9fc76138eddd583d6ac47dd072922d6f66d7d502f6f9a964/numpy-1.
Resolving dependencies... Downloading https://files.pythonhosted.org/packages/fa/07/c6980120967a9fc76138eddd583d6ac47dd072922d6f66d7d502f6f9a964/numpy-1.
Resolving dependencies... Downloading https://files.pythonhosted.org/packages/ab/c3/57f0601a2d4fe15de7a553c00adbc901425661bf048f2a22dfc500caf121/packagin
Resolving dependencies... Downloading https://files.pythonhosted.org/packages/09/7f/dd8cae1ed66d43bdff9e0d250b806d2217a9c18177f4f65cc3e4bc907308/sentence
Resolving dependencies... (4.0s)

Package operations: 7 installs, 0 updates, 0 removals

  • Installing torch (2.0.1): Failed

  RuntimeError

  Hash for torch (2.0.1) from archive torch-2.0.1-cp310-cp310-manylinux1_x86_64.whl not found in known hashes (was: sha256:8dfdf66c88bfcd379e5ecad59447277ae35470bd1589773e62c2ebd21f6efd45)

  at /usr/local/py-utils/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:818 in _validate_archive_hash
      814│         archive_hash: str = "sha256:" + get_file_hash(archive)
      815│         known_hashes = {f["hash"] for f in package.files if f["file"] == archive.name}
      816│ 
      817│         if archive_hash not in known_hashes:
    → 818│             raise RuntimeError(
      819│                 f"Hash for {package} from archive {archive.name} not found in"
      820│                 f" known hashes (was: {archive_hash})"
      821│             )
      822│ 

This is consistent on my end. However if I manually download this same exact wheel from PyPi (https://pypi.org/project/torch/#copy-hash-modal-bfe6a319-e70f-46da-b5a3-183d0f433b02) the hashes match.

This error only occurs when installing the package from Pip or Poetry

[OlegBEZb]

Did your download crash or did you see it finishing? I've just double checked the wheel in question (torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl) from here and the sha256 matches. From PyPI:

e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d

Locally after downloading the file via wget:

sha256sum torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl 
e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d  torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl

which also matches the error message:

Expected sha256 e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d

Dear Piotr! Thank you very much for the reply!

Answering your question, the problem appears in the middle of downloading some of the components.

Example 1

#0 30.64 Collecting nvidia-cudnn-cu11==8.5.0.96 (from torch>=1.6.0->sentence-transformers==2.2.1->-r requirements.txt (line 1))
#0 30.70   Downloading nvidia_cudnn_cu11-8.5.0.96-2-py3-none-manylinux1_x86_64.whl (557.1 MB)
#0 36.61      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━   532.8/557.1 MB 56.1 MB/s eta 0:00:01
#0 37.36 ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
#0 37.36     nvidia-cudnn-cu11==8.5.0.96 from https://files.pythonhosted.org/packages/dc/30/66d4347d6e864334da5bb1c7571305e501dcb11b9155971421bb7bb5315f/nvidia_cudnn_cu11-8.5.0.96-2-py3-none-manylinux1_x86_64.whl (from torch>=1.6.0->sentence-transformers==2.2.1->-r requirements.txt (line 1)):
#0 37.36         Expected sha256 402f40adfc6f418f9dae9ab402e773cfed9beae52333f6d86ae3107a1b9527e7
#0 37.36              Got        39510b73bffcba46ca1b2642ab5f2ff9e1f70f2195dcfeae5d026c5cfd8e0754

Example 2

#0 43.12   Downloading nvidia_cufft_cu11-10.9.0.58-py3-none-manylinux1_x86_64.whl (168.4 MB)
#0 45.30      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━         132.1/168.4 MB 107.4 MB/s eta 0:00:01
#0 45.51 ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
#0 45.51     nvidia-cufft-cu11==10.9.0.58 from https://files.pythonhosted.org/packages/74/79/b912a77e38e41f15a0581a59f5c3548d1ddfdda3225936fb67c342719e7a/nvidia_cufft_cu11-10.9.0.58-py3-none-manylinux1_x86_64.whl (from torch>=1.6.0->sentence-transformers==2.2.1->-r requirements.txt (line 1)):
#0 45.51         Expected sha256 222f9da70c80384632fd6035e4c3f16762d64ea7a843829cb278f98b3cb7dd81
#0 45.51              Got        3f373cf041d6a4865c529a60747c362611e7e451960dc1249997817396b75353

The exact failing component changes from time to time. Apart from that, sometimes this finally works until the end.

I thought this might be related to the fact that I copied the whole project folder with venv to Docker (I didn't mention this in the top message as I thought it was not important) but I dropped all non-source files from the dockerfile and still get the issue.

Another thought was that there is something with my connection. But I can download all these files with wget easily and have a pretty stable and fast connection.

[byt3bl33d3r]

What worked for me was downgrading pip to 20.0.2 by running pip install pip==20.0.2 before installing pytorch.

Out of curiosity @OlegBEZb does this work for you?

[Vivek-Kawathalkar]

Did your download crash or did you see it finishing? I've just double checked the wheel in question (torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl) from here and the sha256 matches. From PyPI:

e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d

Locally after downloading the file via wget:

sha256sum torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl 
e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d  torch-2.0.1-cp311-cp311-manylinux1_x86_64.whl

which also matches the error message:

Expected sha256 e617b1d0abaf6ced02dbb9486803abfef0d581609b09641b34fa315c9c40766d

Dear Piotr! Thank you very much for the reply!

Answering your question, the problem appears in the middle of downloading some of the components.

Example 1

#0 30.64 Collecting nvidia-cudnn-cu11==8.5.0.96 (from torch>=1.6.0->sentence-transformers==2.2.1->-r requirements.txt (line 1))
#0 30.70   Downloading nvidia_cudnn_cu11-8.5.0.96-2-py3-none-manylinux1_x86_64.whl (557.1 MB)
#0 36.61      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━   532.8/557.1 MB 56.1 MB/s eta 0:00:01
#0 37.36 ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
#0 37.36     nvidia-cudnn-cu11==8.5.0.96 from https://files.pythonhosted.org/packages/dc/30/66d4347d6e864334da5bb1c7571305e501dcb11b9155971421bb7bb5315f/nvidia_cudnn_cu11-8.5.0.96-2-py3-none-manylinux1_x86_64.whl (from torch>=1.6.0->sentence-transformers==2.2.1->-r requirements.txt (line 1)):
#0 37.36         Expected sha256 402f40adfc6f418f9dae9ab402e773cfed9beae52333f6d86ae3107a1b9527e7
#0 37.36              Got        39510b73bffcba46ca1b2642ab5f2ff9e1f70f2195dcfeae5d026c5cfd8e0754

Example 2

#0 43.12   Downloading nvidia_cufft_cu11-10.9.0.58-py3-none-manylinux1_x86_64.whl (168.4 MB)
#0 45.30      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━         132.1/168.4 MB 107.4 MB/s eta 0:00:01
#0 45.51 ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
#0 45.51     nvidia-cufft-cu11==10.9.0.58 from https://files.pythonhosted.org/packages/74/79/b912a77e38e41f15a0581a59f5c3548d1ddfdda3225936fb67c342719e7a/nvidia_cufft_cu11-10.9.0.58-py3-none-manylinux1_x86_64.whl (from torch>=1.6.0->sentence-transformers==2.2.1->-r requirements.txt (line 1)):
#0 45.51         Expected sha256 222f9da70c80384632fd6035e4c3f16762d64ea7a843829cb278f98b3cb7dd81
#0 45.51              Got        3f373cf041d6a4865c529a60747c362611e7e451960dc1249997817396b75353

The exact failing component changes from time to time. Apart from that, sometimes this finally works until the end.

I thought this might be related to the fact that I copied the whole project folder with venv to Docker (I didn't mention this in the top message as I thought it was not important) but I dropped all non-source files from the dockerfile and still get the issue.

Another thought was that there is something with my connection. But I can download all these files with wget easily and have a pretty stable and fast connection.

How to solve this issue? i am also getting same

[Leumastai]

anyone solved this issue yet?

[Leumastai]

@byt3bl33d3r solution worked for me by downgrading pip.