#21145 Hash validation with python dependencies from private git repo failing New discussion created by jake-normal I'm running into an issue where hash validation of python dependencies is failing with a message similar to:

stderr:
There was 1 error downloading required artifacts:
1. unstructured 0.14.10.dev12 from git+https://****@github.com/johnathanchiu/unstructured@6a70fc4caab489d88ad1613af9f4a53581d8ffb3
    Expected sha256 hash of 0ceabe966af2f0d63bf4a893c0a510306a460b8037e671e56198ea07483aa638 when downloading unstructured but hashed to d8a7a4be6417b577279adc868641530ed1771790e95f1b610425a55c6ea38114

It looks like another user has run into a similar issue here. I've done my best to create a minimal reproduction of the issue by copying the

__run.sh

script out of the sandbox and trimming it down a bit. Every time I run the is script, the hash of

unstructured

changes:

#!/usr/bin/env bash
# This command line should execute the same process as pants did internally.
env \
  -i \
  CPPFLAGS= LANG=en_US.UTF-8 LDFLAGS= \
  PATH=$'/opt/homebrew/lib/ruby/gems/3.3.0/bin:/opt/homebrew/opt/ruby/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin' \
  PEX_IGNORE_RCFILES=true \
  PEX_PYTHON=/Users/jake/Library/Caches/nce/d52b8d4e72c7ef97d778057e19dcd2dcb2c048c9ac07385c5ea9cc2954831d4b/bindings/venvs/2.21.0/bin/python3.9 \
  PEX_ROOT=.cache/pex_root \
  PEX_SCRIPT=pex3 \
  /Users/jake/Library/Caches/nce/d52b8d4e72c7ef97d778057e19dcd2dcb2c048c9ac07385c5ea9cc2954831d4b/bindings/venvs/2.21.0/bin/python3.9 \
  ./pex lock create --tmpdir .tmp --no-emit-warnings \
  --python-path $'/opt/homebrew/lib/ruby/gems/3.3.0/bin:/opt/homebrew/opt/ruby/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin' \
  $'--output=lock.json' \
  $'--style=universal' \
  --pip-version \
  24.0 \
  --resolver-version pip-2020-resolver \
  --target-system linux \
  --target-system mac \
  $'--indent=2' \
  --no-pypi \
  $'--index=<https://pypi.org/simple/>' \
  --manylinux manylinux2014 \
  --interpreter-constraint $'CPython==3.12.*' $'unstructured[pdf]@ <git+ssh://git@github.com/jake-normal/unstructured@e1a652ad06f8fc1d819ceb2ace73bf0ee285cf9e>'

Find the hash with:

cat lock.json | jq '.locked_resolves | map(.locked_requirements) | first | map(select(.project_name == "unstructured")) | first | .artifacts | first | .hash'

Any idea what might be going on? (Note: I've been testing this with a coworker on two forks,

johnathanchiu

and

jake-normal

, which is the reason for the .) pantsbuild/pants