# Hash-locked bootstrap requirements (OSSF Scorecard Pinned-Dependencies).
#
# Installed with: pip install --require-hashes -r <this file>
# Every byte of the bootstrap toolchain is verified against a reviewed
# sha256. Hashes cover CPython 3.12 (CI runner) and CPython 3.14 (image)
# wheels for linux amd64 and aarch64 as applicable; pure-python wheels are
# shared, platform/abi wheels list one --hash line per artifact.
#
# Regenerate:
#   pip download <roots> --only-binary=:all: --python-version <3.12|3.14>
#     --implementation cp
#     --platform manylinux2014_x86_64 --platform manylinux_2_17_x86_64
#     [--platform manylinux2014_aarch64 --platform manylinux_2_17_aarch64]
#     -d /tmp/hashes
# then re-emit "name==version" with one "--hash=sha256:<digest>" line per
# wheel (run per platform/abi and merge, so tagged wheels carry every hash).
#
# Rotate by bumping the roots to the reviewed versions and regenerating;
# a drifted mirror or wheel-tag makes the install FAIL loudly (by design).
#
# Used by: Dockerfile (ldr stage) and release-gate.yml package verification
# environments - pins pip itself without constraining application dependencies.


pip==26.2.2 \
    --hash=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70 \
    --hash=sha256:3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f
