Run pip install with --require-hashes.

PiperOrigin-RevId: 487569781
Change-Id: I0a810403f789415a3f884531617801ae111c957b

python/make_sdist.sh

@@ -28,8 +28,8 @@ else
   readonly tmp_dir="$(mktemp -d)"
 fi
 
-python -m pip install --upgrade pip setuptools
+python -m pip install --upgrade --require-hashes \
-python -m pip install absl-py
+    -r ${package_dir}/make_sdist_requirements.txt
 pushd ${tmp_dir}
 cp -r "${package_dir}"/* .
 

python/make_sdist_requirements.txt

@@ -0,0 +1,6 @@
+absl-py==1.3.0 \
+    --hash=sha256:34995df9bd7a09b3b8749e230408f5a2a2dd7a68a0d33c12a3d0cb15a041a507
+pip==22.3.1 \
+    --hash=sha256:908c78e6bc29b676ede1c4d57981d490cb892eb45cd8c214ab6298125119e077
+setuptools==65.5.1 \
+    --hash=sha256:d0b9a8433464d5800cbe05094acf5c6d52a91bfac9b52bcfc4d41382be5d5d31