Issue description
Now that we restrict indexes correctly for packages that have pinned indexes, they are winding up with no hashes in the lockfile. It seems there is another condition to utils.collect_hashes that has to be considered, namely the else condition of get the hash from the link.
Actual result (before fix)
{
"_meta": {
"hash": {
"sha256": "dd84b90e2afa892488dc59130dc48898573afeee5ba3aa45d8c64c54be6be39c"
},
"pipfile-spec": 6,
"requires": {
"python_version": "3.10"
},
"sources": [
{
"name": "pypi",
"url": "https://pypi.org/simple",
"verify_ssl": true
},
{
"name": "downloadpytorch",
"url": "https://download.pytorch.org/whl/cu113/",
"verify_ssl": true
},
{
"name": "downloadpytorch-390",
"url": "https://download.pytorch.org/whl/",
"verify_ssl": true
}
]
},
"default": {
"torch": {
"index": "downloadpytorch-390",
"version": "==1.11.0+cu113"
},
"typing-extensions": {
"hashes": [
"sha256:1a9462dcc3347a79b1f1c0271fbe79e844580bb598bafa1ed208b94da3cdcd42",
"sha256:21c85e0fe4b9a155d0799430b0ad741cdce7e359660ccbd8b530613e8df88ce2"
],
"markers": "python_version >= '3.6'",
"version": "==4.1.1"
}
},
"develop": {}
}
Expected result (after change)
{
"_meta": {
"hash": {
"sha256": "a22d7bb22d610cc3aad6f7c9c0a955c862618ad63d3a5f1ada90f4a4e0d6e9cd"
},
"pipfile-spec": 6,
"requires": {
"python_version": "3.10"
},
"sources": [
{
"name": "pypi",
"url": "https://pypi.org/simple",
"verify_ssl": true
},
{
"name": "downloadpytorch",
"url": "https://download.pytorch.org/whl/cu113/",
"verify_ssl": true
},
{
"name": "downloadpytorch-390",
"url": "https://download.pytorch.org/whl/",
"verify_ssl": true
}
]
},
"default": {
"torch": {
"hashes": [
"sha256:ddc57495195aa2456e78bfc7d8d3f45dabbb8b7b268b3b5dbed4f0e4db492f33"
],
"index": "downloadpytorch",
"version": "==1.11.0+cu113"
},
"typing-extensions": {
"hashes": [
"sha256:1a9462dcc3347a79b1f1c0271fbe79e844580bb598bafa1ed208b94da3cdcd42",
"sha256:21c85e0fe4b9a155d0799430b0ad741cdce7e359660ccbd8b530613e8df88ce2"
],
"markers": "python_version >= '3.6'",
"version": "==4.1.1"
}
},
"develop": {}
}
Found while triaging: #5022
Issue description
Now that we restrict indexes correctly for packages that have pinned indexes, they are winding up with no hashes in the lockfile. It seems there is another condition to
utils.collect_hashesthat has to be considered, namely the else condition of get the hash from the link.Actual result (before fix)
Expected result (after change)
Found while triaging: #5022