question about locking of vcs requirements

[sbidoul]

When we pip install then pip freeze an editable vcs requirement, the frozen requirements include all dependencies and the sha of the editable requirements.

With pipenv the dependencies of editable vcs requirements do not appear in Pipfile.lock, nor the sha of the installed version.

$ pipenv install -e git+https://github.com/sbidoul/subdirtest.git#egg=subdirtest\&subdirectory=setup
...
$ cat Pipfile.lock
...
    "default": {
        "subdirtest": {
            "editable": true,
            "git": "https://github.com/sbidoul/subdirtest.git",
            "subdirectory": "setup"
        }
    },
...
$ pipenv run pip freeze
click==6.7
pkg-resources==0.0.0
-e git+https://github.com/sbidoul/subdirtest.git@7b18afe980a42bfe8d1a96b5ed52e05f58d9ef6c#egg=subdirtest&subdirectory=setup

Since the installed package depends on click I expect to see it in the locked dependencies.
I also expect to see the sha of the installed subdirtest in Pipfile.lock.

Is it a missing feature in pipenv? (perhaps I misunderstand something)

[sbidoul]

The example above requires #507

[kennethreitz]

I believe we do not currently resolve dependencies from VCS packages. That would be tricky.

[kennethreitz]

We also don't resolve deps for file dependencies either.

[kennethreitz]

pip-tools currently lacks this ability.

[sbidoul]

FWIW, my use case is pip install -e git+...@branch then pip freeze to get the exact commit used. This is fairly important when working with unreleased dependencies.

BTW, in the tricky department, everything depending on pip internals is going to break with pip 10.0.

[kennethreitz]

Yeah, luckily that's almost nothing on our side — it's all pip-tools dipping into pip's codebase. I hope they're up to the task!

[kennethreitz]

We can see about adding refs to .lock...

[kennethreitz]

Added :)

[sbidoul]

sweet.

Is it normal it goes to the develop section of Pipfile.lock too? (I did not install with --dev, only -e)

[kennethreitz]

that might be a bug.

[kennethreitz]

you're right, it does end up in develop, grrr

[kennethreitz]

found the bug

[kennethreitz]

fixed