Is there a way to generate hashes from an existing installation?

[cleboo]

Hi!

This is more of a question than an issue regarding pip-compile --generate-hashes: if I understand pip-compile correctly, it takes the content of - let's say - a requirements.in file, resolves the packages from indexes (PyPI or others) and writes the hashes it found to requirements.txt.

Is there a way to use already installed packages as a source for the hashes instead of resolving everything from the index?

This would be useful when on-boarding legacy projects that only have a requirements.txt file so far and you want to avoid installing new packages while generating the hash-pinned requirements.txt.

[webknjaz]

Well, things in site-packages/ are unpacked from the dists. So this info is just not there. The installer (like pip) may have some dists cached, but there's no easy way to link them to the installations or know where the installer got them from…

Some info may be present in https://packaging.python.org/en/latest/specifications/recording-installed-packages/ but mostly not.