Turn --verify-hashes on by default

[hauntsaninja]

This would technically be a breaking change, so might need to wait for uv 0.6 (although "I have a hash but I expect it to not be checked" seems pretty niche). It's surprising to me that hashes are ignored by default and it's bad to have security related surprises

λ cat r.txt
pypyp==1.2.0 --hash=sha256:0000000000000000000000000000000000000000000000000000000000000000

λ uv pip install -r r.txt
Using Python 3.11.8 environment at /Users/shantanu/code/venvs/openai-fppa
Resolved 1 package in 26ms
Installed 1 package in 14ms
 + pypyp==1.2.0

λ uv pip uninstall pypyp 
Using Python 3.11.8 environment at /Users/shantanu/code/venvs/openai-fppa
Uninstalled 1 package in 62ms
 - pypyp==1.2.0

λ uv pip install -r r.txt --verify-hashes 
Using Python 3.11.8 environment at /Users/shantanu/code/venvs/openai-fppa
Resolved 1 package in 18ms
error: Failed to prepare distributions
  Caused by: Failed to download `pypyp==1.2.0`
  Caused by: Hash mismatch for `pypyp==1.2.0`

Expected:
  sha256:0000000000000000000000000000000000000000000000000000000000000000

Computed:
  sha256:45e2a0fbe5b7b5bb0be7e95bcb5b23d43ddae8c561410c9c336e6773005c70b1

See also #3305

[hauntsaninja]

Note pip compatibility isn't really an argument here, since in the above example pip will automatically infer --require-hashes:

λ pip install -r r.txt                 
Collecting pypyp==1.2.0 (from -r r.txt (line 1))
  Using cached pypyp-1.2.0-py3-none-any.whl (15 kB)
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
    pypyp==1.2.0 from https://files.pythonhosted.org/packages/e0/6c/6a9eac381dd1f0d2e878ad6213fca24cfe5b3846db46b26d620301ac7624/pypyp-1.2.0-py3-none-any.whl (from -r r.txt (line 1)):
        Expected sha256 0000000000000000000000000000000000000000000000000000000000000000
             Got        45e2a0fbe5b7b5bb0be7e95bcb5b23d43ddae8c561410c9c336e6773005c70b1

[charliermarsh]

Yeah I think --verify-hashes should pretty clearly be the default.

[charliermarsh]

I think it's fine for this to go out in a patch release, personally.

[charliermarsh]

(PR welcome or I'll get to it in the near future ofc.)