# Build toolchain, pinned by hash.
#
# Installed with --require-hashes by the release workflow, so a compromised
# release of any of these cannot execute inside the job that holds the
# publishing identity. Without it, `pipx run build` and
# `requires = ["setuptools>=77"]` resolved from PyPI unpinned at release time,
# which for this project specifically is the whole attack.
#
# Regenerate with:
#   pip download --no-deps -d /tmp/bt build setuptools packaging pyproject_hooks
#   then record each sha256 below.

build==1.2.2.post1 \
    --hash=sha256:1d61c0887fa860c01971625baae8bdd338e517b836a2f70dd1f7aa3a6b2fc5b5
packaging==26.3 \
    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
pyproject-hooks==1.2.0 \
    --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
setuptools==80.9.0 \
    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922
