Pip download prefers newer package version even when local package exists

Environment

• pip version: 10.0.1/master
• Python version: Tested on python 3.6
• OS: Linux

Description pip download does not prefer package found locally even if it satisfies the requirements when there is a newer available at the remote package index

Expected behavior Prefer the already existing package as long as long as it satisfies the dependency requirements

How to Reproduce

1. Create directory pkg_cache
2. Run pip3 download --dest pkg_cache/ --find-links pkg_cache/ setuptools==39.0.1 && pip3 download --dest pkg_cache/ --find-links pkg_cache/ setuptools

Output

pip3 download --dest pkg_cache/  --find-links pkg_cache/ setuptools==39.0.1 && pip3 download --dest pkg_cache/  --find-links pkg_cache/ setuptools
Looking in links: pkg_cache/
Collecting setuptools==39.0.1
  Using cached https://files.pythonhosted.org/packages/20/d7/04a0b689d3035143e2ff288f4b9ee4bf6ed80585cc121c90bfd85a1a8c2e/setuptools-39.0.1-py2.py3-none-any.whl
  Saved ./pkg_cache/setuptools-39.0.1-py2.py3-none-any.whl
Successfully downloaded setuptools
Looking in links: pkg_cache/
Collecting setuptools
  Using cached https://files.pythonhosted.org/packages/7f/e1/820d941153923aac1d49d7fc37e17b6e73bfbd2904959fffbad77900cf92/setuptools-39.2.0-py2.py3-none-any.whl
  Saved ./pkg_cache/setuptools-39.2.0-py2.py3-none-any.whl
Successfully downloaded setuptools

[pfmoore]

OK, so what you’re suggesting is an option to pip download that says "for each requirement, if it can already be satisfied from the destination directory, skip it, otherwise download the requirement as normal and store the downloaded file in the destination directory.

I can see the logic in that. If you wanted to create a PR implementing it, I’m not going to object. I can’t say that I find your justification for the behaviour compelling, but that’s something that can be debated later, when there’s a PR to review.

[pfmoore]

Sigh. I guess we’re simply going to have to disagree. Pip has mechanisms (version pinning, hash checking) to satisfy your requirement (1). Just because you choose not to use them, or because they don’t work easily in your particular situation, doesn’t mean pip can’t do that. Nor does it mean that pip needs another method of doing the same thing.

I remain -1 on this whole proposal, and you’ve pretty much convinced me that accepting the option for pip download will set a precedent that will make it impossible to resist demands that we add it to pip install. So I’m no longer willing to make an exception for pip download.