Merge pull request #3147 from pypa/bugfix/3106

 Don't write build artifacts to cwd

news/2394.bugfix.rst

@@ -0,0 +1 @@
+Remote non-PyPI artifacts and local wheels and artifacts will now include their own hashes rather than including hashes from ``PyPI``.

news/3106.bugfix.rst

@@ -0,0 +1 @@
+Pipenv will avoid leaving build artifacts in the current working directory.

news/3145.bugfix.rst

@@ -0,0 +1 @@
+Remote non-PyPI artifacts and local wheels and artifacts will now include their own hashes rather than including hashes from ``PyPI``.

pipenv/utils.py

@@ -221,14 +221,18 @@ def actually_resolve_deps(
     from pipenv.patched.piptools import logging as piptools_logging
     from pipenv.patched.piptools.exceptions import NoCandidateFound
     from .vendor.requirementslib.models.requirements import Requirement
-    from .vendor.vistir.path import create_tracked_tempdir, create_tracked_tempfile
+    from .vendor.vistir.path import (
+        create_tracked_tempdir, create_tracked_tempfile, url_to_path,
+    )
+    from .vendor.vistir.compat import Path, to_native_string
 
     class PipCommand(Command):
         """Needed for pip-tools."""
 
         name = "PipCommand"
 
     constraints = []
+    needs_hash = []
     if not req_dir:
         req_dir = create_tracked_tempdir(suffix="-requirements", prefix="pipenv-")
     for dep in deps:
@@ -240,6 +244,9 @@ class PipCommand(Command):
             url = indexes[0]
         dep = " ".join(remainder)
         req = Requirement.from_line(dep)
+        new_ireq = req.as_ireq()
+        if getattr(new_ireq, "link", None) and new_ireq.link.is_wheel and new_ireq.link.scheme == 'file':
+            needs_hash.append(new_ireq)
 
         # extra_constraints = []
 
@@ -288,10 +295,17 @@ class PipCommand(Command):
         constraints=constraints, repository=pypi, clear_caches=clear, prereleases=pre
     )
     # pre-resolve instead of iterating to avoid asking pypi for hashes of editable packages
-    hashes = None
+    hashes = {
+        ireq: pypi._hash_cache.get_hash(ireq.link)
+        for ireq in constraints if (getattr(ireq, "link", None)
+        # We can only hash artifacts, but we don't want normal pypi artifcats since the
+        # normal resolver handles those
+        and ireq.link.is_artifact and not (is_pypi_url(ireq.link.url) or
+        # We also don't want to try to hash directories as this will fail (editable deps)
+        (ireq.link.scheme == "file" and Path(to_native_string(url_to_path(ireq.link.url))).is_dir())))
+    }
     try:
         results = resolver.resolve(max_rounds=environments.PIPENV_MAX_ROUNDS)
-        hashes = resolver.resolve_hashes(results)
         resolved_tree.update(results)
     except (NoCandidateFound, DistributionNotFound, HTTPError) as e:
         click_echo(
@@ -318,6 +332,11 @@ class PipCommand(Command):
                 ), err=True
             )
         raise RuntimeError
+    else:
+        resolved_hashes = resolver.resolve_hashes(results)
+        for ireq, ireq_hashes in resolved_hashes.items():
+            if ireq not in hashes:
+                hashes[ireq] = ireq_hashes
     return (resolved_tree, hashes, markers_lookup, resolver)
 
 

pipenv/vendor/requirementslib/__init__.py

@@ -1,5 +1,5 @@
 # -*- coding=utf-8 -*-
-__version__ = '1.2.3'
+__version__ = '1.2.4'
 
 import logging
 

pipenv/vendor/requirementslib/utils.py

@@ -186,7 +186,14 @@ def ensure_setup_py(base_dir):
     if not base_dir:
         base_dir = create_tracked_tempdir(prefix="requirementslib-setup")
     base_dir = Path(base_dir)
+    if base_dir.exists() and base_dir.name == "setup.py":
+        base_dir = base_dir.parent
+    elif not (base_dir.exists() and base_dir.is_dir()):
+        base_dir = base_dir.parent
+        if not (base_dir.exists() and base_dir.is_dir()):
+            base_dir = base_dir.parent
     setup_py = base_dir.joinpath("setup.py")
+
     is_new = False if setup_py.exists() else True
     if not setup_py.exists():
         setup_py.write_text(u"")

pipenv/vendor/vendor.txt

@@ -27,7 +27,7 @@ requests==2.20.0
     idna==2.7
     urllib3==1.24
     certifi==2018.10.15
-requirementslib==1.2.3
+requirementslib==1.2.4
     attrs==18.2.0
     distlib==0.2.8
     packaging==18.0