Compute require_hashes in populate_requirement_set

src/pip/_internal/cli/req_command.py

@@ -226,9 +226,6 @@ class RequirementCommand(IndexGroupCommand):
         """
         Marshal cmd line args into a requirement set.
         """
-        # NOTE: As a side-effect, options.require_hashes and
-        #       requirement_set.require_hashes may be updated
-
         for filename in options.constraints:
             for req_to_add in parse_requirements(
                     filename,
@@ -256,6 +253,7 @@ class RequirementCommand(IndexGroupCommand):
             req_to_add.is_direct = True
             requirement_set.add_requirement(req_to_add)
 
+        # NOTE: options.require_hashes may be set if --require-hashes is True
         for filename in options.requirements:
             for req_to_add in parse_requirements(
                     filename,
@@ -265,6 +263,14 @@ class RequirementCommand(IndexGroupCommand):
                 req_to_add.is_direct = True
                 requirement_set.add_requirement(req_to_add)
 
+        # If any requirement has hash options, enable hash checking.
+        requirements = (
+            requirement_set.unnamed_requirements +
+            list(requirement_set.requirements.values())
+        )
+        if any(req.has_hash_options for req in requirements):
+            options.require_hashes = True
+
         if not (args or options.editables or options.requirements):
             opts = {'name': self.name}
             if options.find_links:

src/pip/_internal/legacy_resolve.py

@@ -176,11 +176,6 @@ class Resolver(object):
             list(requirement_set.requirements.values())
         )
 
-        require_hashes = (
-            self.require_hashes_option or
-            any(req.has_hash_options for req in root_reqs)
-        )
-
         # Actually prepare the files, and collect any exceptions. Most hash
         # exceptions cannot be checked ahead of time, because
         # req.populate_link() needs to be called before we can make decisions
@@ -190,7 +185,9 @@ class Resolver(object):
         for req in chain(root_reqs, discovered_reqs):
             try:
                 discovered_reqs.extend(
-                    self._resolve_one(requirement_set, req, require_hashes)
+                    self._resolve_one(
+                        requirement_set, req, self.require_hashes_option
+                    )
                 )
             except HashError as exc:
                 exc.req = req