Installation failed due to missing hashes when using --skip-lock

[davehunt]

Issue description

When installing certain packages such as zope-components using --skip-lock an error occurs due to missing hashes.

Expected result

Package listing in Pipfile is installed along with all transient dependencies.

Actual result

Package installation fails with:

Traceback (most recent call last):
  File "/Users/dhunt/.local/share/virtualenvs/pipenv-scratchpad--GgvuMLL/lib/python3.7/site-packages/pip/_internal/cli/base_command.py", line 143, in main
    status = self.run(options, args)
  File "/Users/dhunt/.local/share/virtualenvs/pipenv-scratchpad--GgvuMLL/lib/python3.7/site-packages/pip/_internal/commands/install.py", line 318, in run
    resolver.resolve(requirement_set)
  File "/Users/dhunt/.local/share/virtualenvs/pipenv-scratchpad--GgvuMLL/lib/python3.7/site-packages/pip/_internal/resolve.py", line 109, in resolve
    raise hash_errors
pip._internal.exceptions.HashErrors: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    zope.deferredimport>=4.2.1 from https://files.pythonhosted.org/packages/62/d2/e03e4b0c9103817e19d1ea577c1f7fb9b67e4c0397ca5127d377e1eafe0c/zope.deferredimport-4.3-py2.py3-none-any.whl#sha256=4aae9cbacb2146cca58e62be0a914f0cec034d3b2d41135ea212ca8a96f4b5ec (from zope-component==4.5->-r /var/folders/wz/3v_j7g2n2zx_q6qs8g7vmyg00000gn/T/pipenv-vezy9g1n-requirements/pipenv-xv4pd16_-requirement.txt (line 1))
Traceback (most recent call last):
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/bin/pipenv", line 11, in <module>
    load_entry_point('pipenv==2018.11.14', 'console_scripts', 'pipenv')()
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/core.py", line 1137, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/decorators.py", line 64, in new_func
    return ctx.invoke(f, obj, *args, **kwargs)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/vendor/click/decorators.py", line 17, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/cli/command.py", line 249, in install
    editable_packages=state.installstate.editables,
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/core.py", line 1872, in do_install
    keep_outdated=keep_outdated
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/core.py", line 1232, in do_init
    pypi_mirror=pypi_mirror,
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/core.py", line 844, in do_install_dependencies
    _cleanup_procs(procs, False, failed_deps_queue, retry=False)
  File "/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv/core.py", line 676, in _cleanup_procs
    raise exceptions.InstallError(c.dep.name, extra=err_lines)
pipenv.exceptions.InstallError: ERROR: ERROR: Package installation failed...

Steps to replicate

$ pipenv install zope.component
$ pipenv --rm
$ pipenv install --skip-lock

---

$ pipenv --support

Pipenv version: '2018.11.14'

Pipenv location: '/usr/local/Cellar/pipenv/2018.11.14/libexec/lib/python3.7/site-packages/pipenv'

Python location: '/usr/local/Cellar/pipenv/2018.11.14/libexec/bin/python3.7'

Python installations found:

• 3.7.1: /usr/local/bin/python3
• 3.7.1: /usr/local/bin/python3.7m
• 3.7.0: /Users/dhunt/.pyenv/versions/3.7.0/bin/python3
• 3.7.0: /Users/dhunt/.pyenv/versions/3.7.0/bin/python3.7m
• 3.7.0: /Users/dhunt/.pyenv/versions/tmp-3.7.0-dhunt-oYjJx3/bin/python3
• 3.7.0: /Users/dhunt/.pyenv/versions/tmp-3.7.0-wpt-api-6xB6J5/bin/python3
• 3.6.5: /Users/dhunt/.pyenv/versions/3.6.5/bin/python3
• 3.6.5: /Users/dhunt/.pyenv/versions/3.6.5/bin/python3.6m
• 3.5.5: /Users/dhunt/.pyenv/versions/3.5.5/bin/python3
• 3.5.5: /Users/dhunt/.pyenv/versions/3.5.5/bin/python3.5m
• 3.4.8: /Users/dhunt/.pyenv/versions/3.4.8/bin/python3
• 3.4.8: /Users/dhunt/.pyenv/versions/3.4.8/bin/python3.4m
• 2.7.15: /Users/dhunt/.pyenv/versions/2.7.15/bin/python
• 2.7.15: /Users/dhunt/.pyenv/versions/selenium/bin/python
• 2.7.15: /Users/dhunt/.pyenv/versions/tmp-2.7.15-dhunt-lmhFAI/bin/python
• 2.7.15: /usr/local/bin/python
• 2.7.15: /usr/local/bin/pythonw
• 2.7.13: /Users/dhunt/.pyenv/versions/pypy-5.7.1/bin/python
• 2.7.10: /usr/bin/python
• 2.7.10: /usr/bin/pythonw
• 2.7.10: /usr/bin/python2.7

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.7.1',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '18.0.0',
 'platform_system': 'Darwin',
 'platform_version': 'Darwin Kernel Version 18.0.0: Wed Aug 22 20:13:40 PDT '
                     '2018; root:xnu-4903.201.2~1/RELEASE_X86_64',
 'python_full_version': '3.7.1',
 'python_version': '3.7',
 'sys_platform': 'darwin'}

System environment variables:

• PATH
• SPACESHIP_VERSION
• TERM_PROGRAM
• NVM_CD_FLAGS
• TERM
• SHELL
• TMPDIR
• Apple_PubSub_Socket_Render
• TERM_PROGRAM_VERSION
• TERM_SESSION_ID
• NVM_DIR
• USER
• SSH_AUTH_SOCK
• __CF_USER_TEXT_ENCODING
• PYENV_VIRTUALENV_INIT
• PAGER
• LSCOLORS
• _
• PWD
• LANG
• ITERM_PROFILE
• XPC_FLAGS
• SPACESHIP_ROOT
• XPC_SERVICE_NAME
• PYENV_SHELL
• SHLVL
• HOME
• COLORFGBG
• ITERM_SESSION_ID
• LESS
• LOGNAME
• LC_CTYPE
• NVM_BIN
• DISPLAY
• COLORTERM
• PIP_DISABLE_PIP_VERSION_CHECK
• PYTHONDONTWRITEBYTECODE
• PIP_SHIMS_BASE_MODULE
• PIP_PYTHON_PATH
• PYTHONFINDER_IGNORE_UNSUPPORTED

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /usr/local/Cellar/pipenv/2018.11.14/libexec/tools:/Users/dhunt/.local/bin:/Users/dhunt/.nvm/versions/node/v6.11.1/bin:/Users/dhunt/.cargo/bin:/usr/local/Cellar/pyenv-virtualenv/1.1.3/shims:/Users/dhunt/.pyenv/shims:/Users/dhunt/.cargo/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/MacGPG2/bin:/opt/X11/bin::/Users/dhunt/workspace/arcanist/bin/
• SHELL: /usr/local/bin/zsh
• LANG: en_GB.UTF-8
• PWD: /Users/dhunt/workspace/pipenv-scratchpad

---

Contents of Pipfile ('/Users/dhunt/workspace/pipenv-scratchpad/Pipfile'):

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[dev-packages]

[packages]
zope-component = "*"

[requires]
python_version = "3.7"

Contents of Pipfile.lock ('/Users/dhunt/workspace/pipenv-scratchpad/Pipfile.lock'):

{
    "_meta": {
        "hash": {
            "sha256": "24753e1cdbac9ea44971cbde4168d8a4cba1360797c0041e8ab435dac8d5ed49"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.7"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "zope-component": {
            "hashes": [
                "sha256:984a06ba3def0b02b1117fa4c45b56e772e8c29c0340820fbf367e440a93a3a4"
            ],
            "index": "pypi",
            "version": "==4.5"
        },
        "zope.deferredimport": {
            "hashes": [
                "sha256:2ddef5a7ecfff132a2dd796253366ecf9748a446e30f1a0b3a636aec9d9c05c5",
                "sha256:4aae9cbacb2146cca58e62be0a914f0cec034d3b2d41135ea212ca8a96f4b5ec"
            ],
            "version": "==4.3"
        },
        "zope.deprecation": {
            "hashes": [
                "sha256:7d52e134bbaaa0d72e1e2bc90f0587f1adc116c4bdf15912afaf2f1e8856b224",
                "sha256:c83cfef3085d10dcb07de5a59a2d95713865befa46e0e88784c5648610fba789"
            ],
            "version": "==4.3.0"
        },
        "zope.event": {
            "hashes": [
                "sha256:69c27debad9bdacd9ce9b735dad382142281ac770c4a432b533d6d65c4614bcf",
                "sha256:d8e97d165fd5a0997b45f5303ae11ea3338becfe68c401dd88ffd2113fe5cae7"
            ],
            "version": "==4.4"
        },
        "zope.hookable": {
            "hashes": [
                "sha256:22886e421234e7e8cedc21202e1d0ab59960e40a47dd7240e9659a2d82c51370",
                "sha256:39912f446e45b4e1f1951b5ffa2d5c8b074d25727ec51855ae9eab5408f105ab",
                "sha256:3adb7ea0871dbc56b78f62c4f5c024851fc74299f4f2a95f913025b076cde220",
                "sha256:3d7c4b96341c02553d8b8d71065a9366ef67e6c6feca714f269894646bb8268b",
                "sha256:4e826a11a529ed0464ffcecf34b0b7bd1b4928dd5848c5c61bedd7833e8f4801",
                "sha256:700d68cc30728de1c4c62088a981c6daeaefdf20a0d81995d2c0b7f442c5f88c",
                "sha256:77c82a430cedfbf508d1aa406b2f437363c24fa90c73f577ead0fb5295749b83",
                "sha256:c1df3929a3666fc5a0c80d60a0c1e6f6ef97c7f6ed2f1b7cf49f3e6f3d4dde15",
                "sha256:dba8b2dd2cd41cb5f37bfa3f3d82721b8ae10e492944e48ddd90a439227f2893",
                "sha256:f492540305b15b5591bd7195d61f28946bb071de071cee5d68b6b8414da90fd2"
            ],
            "version": "==4.2.0"
        },
        "zope.interface": {
            "hashes": [
                "sha256:086707e0f413ff8800d9c4bc26e174f7ee4c9c8b0302fbad68d083071822316c",
                "sha256:1157b1ec2a1f5bf45668421e3955c60c610e31913cc695b407a574efdbae1f7b",
                "sha256:11ebddf765bff3bbe8dbce10c86884d87f90ed66ee410a7e6c392086e2c63d02",
                "sha256:14b242d53f6f35c2d07aa2c0e13ccb710392bcd203e1b82a1828d216f6f6b11f",
                "sha256:1b3d0dcabc7c90b470e59e38a9acaa361be43b3a6ea644c0063951964717f0e5",
                "sha256:20a12ab46a7e72b89ce0671e7d7a6c3c1ca2c2766ac98112f78c5bddaa6e4375",
                "sha256:298f82c0ab1b182bd1f34f347ea97dde0fffb9ecf850ecf7f8904b8442a07487",
                "sha256:2f6175722da6f23dbfc76c26c241b67b020e1e83ec7fe93c9e5d3dd18667ada2",
                "sha256:3b877de633a0f6d81b600624ff9137312d8b1d0f517064dfc39999352ab659f0",
                "sha256:4265681e77f5ac5bac0905812b828c9fe1ce80c6f3e3f8574acfb5643aeabc5b",
                "sha256:550695c4e7313555549aa1cdb978dc9413d61307531f123558e438871a883d63",
                "sha256:5f4d42baed3a14c290a078e2696c5f565501abde1b2f3f1a1c0a94fbf6fbcc39",
                "sha256:62dd71dbed8cc6a18379700701d959307823b3b2451bdc018594c48956ace745",
                "sha256:7040547e5b882349c0a2cc9b50674b1745db551f330746af434aad4f09fba2cc",
                "sha256:7e099fde2cce8b29434684f82977db4e24f0efa8b0508179fce1602d103296a2",
                "sha256:7e5c9a5012b2b33e87980cee7d1c82412b2ebabcb5862d53413ba1a2cfde23aa",
                "sha256:81295629128f929e73be4ccfdd943a0906e5fe3cdb0d43ff1e5144d16fbb52b1",
                "sha256:95cc574b0b83b85be9917d37cd2fad0ce5a0d21b024e1a5804d044aabea636fc",
                "sha256:968d5c5702da15c5bf8e4a6e4b67a4d92164e334e9c0b6acf080106678230b98",
                "sha256:9e998ba87df77a85c7bed53240a7257afe51a07ee6bc3445a0bf841886da0b97",
                "sha256:a0c39e2535a7e9c195af956610dba5a1073071d2d85e9d2e5d789463f63e52ab",
                "sha256:a15e75d284178afe529a536b0e8b28b7e107ef39626a7809b4ee64ff3abc9127",
                "sha256:a6a6ff82f5f9b9702478035d8f6fb6903885653bff7ec3a1e011edc9b1a7168d",
                "sha256:b639f72b95389620c1f881d94739c614d385406ab1d6926a9ffe1c8abbea23fe",
                "sha256:bad44274b151d46619a7567010f7cde23a908c6faa84b97598fd2f474a0c6891",
                "sha256:bbcef00d09a30948756c5968863316c949d9cedbc7aabac5e8f0ffbdb632e5f1",
                "sha256:d788a3999014ddf416f2dc454efa4a5dbeda657c6aba031cf363741273804c6b",
                "sha256:eed88ae03e1ef3a75a0e96a55a99d7937ed03e53d0cffc2451c208db445a2966",
                "sha256:f99451f3a579e73b5dd58b1b08d1179791d49084371d9a47baad3b22417f0317"
            ],
            "version": "==4.6.0"
        },
        "zope.proxy": {
            "hashes": [
                "sha256:0cbcfcafaa3b5fde7ba7a7b9a2b5f09af25c9b90087ad65f9e61359fed0ca63b",
                "sha256:3de631dd5054a3a20b9ebff0e375f39c0565f1fb9131200d589a6a8f379214cd",
                "sha256:5429134d04d42262f4dac25f6dea907f6334e9a751ffc62cb1d40226fb52bdeb",
                "sha256:563c2454b2d0f23bca54d2e0e4d781149b7b06cb5df67e253ca3620f37202dd2",
                "sha256:5bcf773345016b1461bb07f70c635b9386e5eaaa08e37d3939dcdf12d3fdbec5",
                "sha256:8d84b7aef38c693874e2f2084514522bf73fd720fde0ce2a9352a51315ffa475",
                "sha256:90de9473c05819b36816b6cb957097f809691836ed3142648bf62da84b4502fe",
                "sha256:dd592a69fe872445542a6e1acbefb8e28cbe6b4007b8f5146da917e49b155cc3",
                "sha256:e7399ab865399fce322f9cefc6f2f3e4099d087ba581888a9fea1bbe1db42a08",
                "sha256:e7d1c280d86d72735a420610df592aac72332194e531a8beff43a592c3a1b8eb",
                "sha256:e90243fee902adb0c39eceb3c69995c0f2004bc3fdb482fbf629efc656d124ed"
            ],
            "version": "==4.3.1"
        }
    },
    "develop": {}
}

[duplicate-issues]

Hey @davehunt,

We did a quick check and this issue looks very darn similar to

• #3254 - Update requirementslib and pythonfinder
• #3253 - Fix parsing of markers in VCS requirements
• #3252 - Updated graph command docstrings, fixes #3071

This could be a coincidence, but if any of these issues solves your problem then I did a good job 😄

If not, the maintainers will get to this issue shortly.

Cheers,
Your Friendly Neighborhood ProBot