There is lots of inconsistency about hash behavior with the various repos (pypi, ruby gems) and tools (poetry, bundled).

For a long time poetry didn’t even check the hash. So the safer option is just maintain these artifacts yourself so you know what is going on and have your own policies on maintaining them.