Use local hashes in the requirements.txt file.

[dumol]

As per https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode.

[adiroiban]

Note that those hashes only work for direct dependencies.

For pythia, should be ok, as we only have simple dependencies ... with the exception of setuptools.

A better option is to use pip lock files. These files are generating hashed for the full dependency tree.

As we update the pip tooling, maybe we can try to look into using uv for pythia