In #510 the missing setuptools dependency was added without a specific version requirement. This is problematic if one uses a requirement file with hashes and results in this error:

ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    setuptools from https://files.pythonhosted.org/...snip...
(from jsonschema==3.0.1->-r requirments.txt)

I do not know what would be a sensible version but as this was released in https://github.com/Julian/jsonschema/releases/tag/v3.0.0a4 it maybe makes sense to use the current version of setuptools at this point in time? This would be setuptools>=40.6.3.
I'm happy to create a PR once we decide on the version.