'Return a hash-comparer that considers my option- and URL-based
hashes to be known-good.
Hashes in URLs--ones embedded in the requirements file, not ones
downloaded from an index server--are almost peers with ones from
flags. They satisfy --require-hashes (whether it was implicitly or
explicitly activated) but do not activate it. md5 and sha224 are not
allowed in flags, which should nudge people toward good algos. We
always OR all hashes together, even ones from URLs.
:param trust_internet: Whether to trust URL-based (#md5=...) hashes
downloaded from the internet, as by populate_link()'

def hashes(self, trust_internet=True):

    good_hashes = self.options.get('hashes', {}).copy()
    link = (self.link if trust_internet else self.original_link)
    if (link and link.hash):
        good_hashes.setdefault(link.hash_name, []).append(link.hash)
    return Hashes(good_hashes)
