Work with provided hashes

[ghost]

What's the problem this feature will solve?

Let's say I want to ensure the hashes for a package I've found are the ones I've decided on.

I could have a req.in file like this:

flymetothemoon==1.4.1 --hash=sha256:e9c771b6136f2392f5c1ca2c8045d0e503981f8c90a111213473e4644765df4f

pip-compile will ignore the provided hash(es), and fetch/generate new ones with the --generate-hashes option.

Describe the solution you'd like

• Analogous to how pip does/wants it, --generate-hashes is implied if --hash appears for any package.
• Hashes provided in input files aren't clobbered. If there's something wrong with them, or I have not provided enough, then that's my problem.

Being able to provide hashes explicitly is useful if I'm computing them myself.

[atugushev]

Just out of the curiosity, what's the use case for this feature in the wild?