def get_hashes(self, candidate: Candidate) -> list[FileHash]:
        """Get hashes of all possible installable candidates
        of a given package version.
        """
        if (
            candidate.req.is_vcs or (candidate.req.is_file_or_url and candidate.req.is_local_dir)  # type: ignore[attr-defined]
        ):
            return []
        if candidate.hashes and candidate.req.is_named:
            return candidate.hashes
        req = candidate.req.as_pinned_version(candidate.version)
        comes_from = candidate.link.comes_from if candidate.link else None
        result: list[FileHash] = []
        logged = False
        respect_source_order = self.environment.project.pyproject.settings.get("resolution", {}).get(
            "respect-source-order", False
        )
        sources = self.get_filtered_sources(candidate.req)
        if req.is_named and respect_source_order and comes_from:
            sources = [s for s in sources if comes_from.startswith(cast(str, s.url))]

        if req.is_file_or_url:
            this_link = cast("Link", candidate.prepare(self.environment).link)
            links: list[Link] = [this_link]
        else:  # the req must be a named requirement
            with self.environment.get_finder(sources, env_spec=self.env_spec) as finder:
                links = [package.link for package in finder.find_matches(req.as_line())]
        for link in links:
            if not link or link.is_vcs or (link.is_file and link.file_path.is_dir()):
                # The links found can still be a local directory or vcs, skipping it.
                continue
            if not logged:
                termui.logger.info("Fetching hashes for %s", candidate)
                logged = True
            result.append(
                {
                    "url": link.url_without_fragment,
                    "file": link.filename,
                    "hash": self._hash_cache.get_hash(link, self.environment.session),
                }
            )
        return result
Get hashes of all possible installable candidates
        of a given package version.
        
src/pdm/models/repositories/base.py