Package reports
Requirements pin and hash audit
Flag unpinned or unhashed named requirements in a requirements file.
Your inputs
Start with an exampleYour result
Example resultAa — A small example of your colors.
How it works
Join continued lines, find exact named version pins and check SHA-256/384/512 hash syntax. Report unsupported includes/editables.
The example uses one exact version and one 64-digit SHA-256 hash; neither is flagged by these local checks.
Limits
No package/index access or digest verification. Markers are not evaluated; nested files are not followed. Passing these checks does not establish package authenticity or a reproducible full environment.