I don't know where you got that from, it actually looks like this: FooProject == 1.2 --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362

I don't know where you got that from, it actually looks like this: FooProject == 1.2 --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 Follow the link "Hash-checking Mode" from the page you linked.