pip哈希锁定与requirements治理（--require-hashes-来源）最佳实践

实现示例type Req = { name: string; version: string; hash: string; url?: string } const allowHosts = new Set<string>(['pypi.org','files.pythonhosted.org','pypi.example.com']) function hex64(h: string): boolean { return /^[A-Fa-f0-9]{64}$/.test(h) } function validUrl(u?: string): boolean { if (!u) return true; try { const x = new URL(u); return x.protocol === 'https:' && allowHosts.has(x.host) } catch { return false } } function semverLike(v: string): boolean { return /^(\d+\.\d+\.\d+)(?:[-A-Za-z0-9_.]+)?$/.test(v) } function evaluate(list: Req[]): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const r of list) { if (!r.name || !semverLike(r.version)) errors.push(`id:${r.name}`) if (!hex64(r.hash)) errors.push(`hash:${r.name}`) if (!validUrl(r.url)) errors.push(`url:${r.name}`) } return { ok: errors.length === 0, errors } } 审计与运行治理审计哈希与来源；构建安装必须启用 `--require-hashes` 并拒绝缺失哈希项。来源变更需审批与记录，支持回溯。