Intermittent Hash Validation Failures

• Poetry version: 1.4.2
• Python version: 3.10.6
• OS version and name: Ubuntu 22.04.2 LTS (running in a docker image based on this)
• pyproject.toml: https://gist.github.com/rohanp-eiq/3171fb1561994642b2580313b1939a29

• I am on the latest stable Poetry version, installed using a recommended method.
• I have searched the issues of this repo and believe that this is not a duplicate.
• I have consulted the FAQ and blog for any relevant entries or release notes.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option) and have included the output below.

Issue

Hi, we are running into an issue where we intermittently see libraries failing to install with the command: poetry install -vvv --with dev,test --sync with the following error (torch is an example, this has failed on other libraries):

  7  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:280 in _execute_operation
      278│ 
      279│             try:
    → 280│                 result = self._do_execute_operation(operation)
      281│             except EnvCommandError as e:
      282│                 if e.e.returncode == -2:

  6  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:382 in _do_execute_operation
      380│             return 0
      381│ 
    → 382│         result: int = getattr(self, f"_execute_{method}")(operation)
      383│ 
      384│         if result != 0:

  5  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:502 in _execute_install
      500│ 
      501│     def _execute_install(self, operation: Install | Update) -> int:
    → 502│         status_code = self._install(operation)
      503│ 
      504│         self._save_url_reference(operation)

  4  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:540 in _install
      538│             archive = self._download_link(operation, Link(package.source_url))
      539│         else:
    → 540│             archive = self._download(operation)
      541│ 
      542│         operation_message = self.get_operation_message(operation)

  3  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:715 in _download
      713│             self._yanked_warnings.append(message)
      714│ 
    → 715│         return self._download_link(operation, link)
      716│ 
      717│     def _download_link(self, operation: Install | Update, link: Link) -> Path:

  2  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:754 in _download_link
      752│ 
      753│         # Use the original archive to provide the correct hash.
    → 754│         self._populate_hashes_dict(original_archive, package)
      755│ 
      756│         return archive

  1  ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:760 in _populate_hashes_dict
      758│     def _populate_hashes_dict(self, archive: Path, package: Package) -> None:
      759│         if package.files and archive.name in {f["file"] for f in package.files}:
    → 760│             archive_hash = self._validate_archive_hash(archive, package)
      761│             self._hashes[package.name] = archive_hash
      762│ 

  RuntimeError

  Hash for torch (2.0.0) from archive torch-2.0.0-cp310-cp310-manylinux1_x86_64.whl not found in known hashes (was: sha256:1056dbd19648e16b410f610ae6e556a783ed566b18ddcb49c8af688c70748e48)

  at ~/.local/pipx/venvs/poetry/lib/python3.10/site-packages/poetry/installation/executor.py:769 in _validate_archive_hash
      765│         archive_hash: str = "sha256:" + get_file_hash(archive)
      766│         known_hashes = {f["hash"] for f in package.files if f["file"] == archive.name}
      767│ 
      768│         if archive_hash not in known_hashes:
    → 769│             raise RuntimeError(
      770│                 f"Hash for {package} from archive {archive.name} not found in"
      771│                 f" known hashes (was: {archive_hash})"
      772│             )
      773│ 

We have seen this mostly occur in Github actions. The relevant steps are:

  - name: Install Poetry
        run: pipx install poetry

  - uses: actions/setup-python@v4.6.0
    with:
      python-version: "${{ env.PYTHON_VERSION }}" # this is 3.10.6

   - name: install deps
      run: |
      poetry install --with dev,test --sync 

We see intermittent issues with different libraries failing on hash checks, and retrying with no changes ends up fixing the problem.

We've tried adding steps like: poetry cache clear . --all and

rm -rf ~/.cache/pypoetry/cache
rm -rf ~/.cache/pypoetry/artifacts
poetry lock --no-update

but haven't had any luck. Additionally, we've verified that the runner isn't caching data in a way that would be causing issues.

Thank you for any help in advance!

Start in poetry/installation/executor.py, especially _download_link, _populate_hashes_dict, and _validate_archive_hash, using the reported stack trace as the entry point. Reproduce the poetry install --with dev,test --sync command in the described GitHub Actions environment and trace intermittent archive-hash failures; done means installs no longer reject valid archives because of inconsistent known hashes.