"extras" are brought into the extra package's lockfile entry as "markers"

Issue description

The title is a bit confusing, so I’ll just get straight into the setup. Here’s my pipfile:

[[source]]

url = "https://pypi.python.org/simple"
verify_ssl = true
name = "pypi"


[packages]

babel = "==2.6.0"
boto3 = "==1.9.23"
celery = "==4.2.1"
colorama = "==0.4.0"
coreapi = "==2.3.3"
dj-database-url = "==0.5.0"
djangorestframework = "==3.8.2"
django = "==2.1.2"
django-axes = "==4.4.0"
django-celery-results = "==1.0.1"
django-clever-selects = "==0.8.2"
django-crispy-forms = "==1.7.2"
django-choices = "==1.6.1"
django-extra-views = "==0.11.0"
django-filter = "==2.0.0"
django-hijack = "==2.1.10"
django-hijack-admin = "==2.1.10"
django-js-reverse = "==0.8.2"
django-model-utils = "==3.1.2"
django-phonenumber-field = "==2.0.1"
django-polymorphic = "==2.0.3"
django-redis-cache = "==1.7.1"
django-role-permissions = "==2.2.0"
django-s3direct = "==1.0.4"
django-storages = "==1.7.1"
django-tables2 = "==1.21.2"
django-tagulous = "==0.13.2"
django-webpack-loader = "==0.6.0"
django-widget-tweaks = "==1.4.3"
facebook_business = "==3.1.9"
googleads = "==14.1.0"
markdown = "==3.0.1"
pillow = "==5.3.0"
psycopg2-binary = "==2.7.5"
pygments = "==2.2.0"
pyssim = "==0.4"
python-dotenv = "==0.9.1"
pytz = "==2018.5"
raven = "==6.9.0"
sendgrid-django = "==4.2.0"
slacker = "==0.9.65"
termcolor = "==1.1.0"
tqdm = "==4.26.0"
twitter-ads = "==3.0.0"
waitress = "==1.1.0"


[dev-packages]

coverage = "==4.5.1"
selenium = "==3.14.1"
tblib = "==1.3.2"
flake8 = "==3.5.0"
django-debug-toolbar = "==1.10.1"
django-extensions = "==2.1.3"
unittest-xml-reporting = "==2.2.0"


[requires]

python_version = "3.6"


[packages.django-static-precompiler]

extras = [ "libsass",]
version = "==1.8.2"


[packages.whitenoise]

extras = [ "brotli",]
version = "==4.0"

Notice the packages syntax. This is put in automatically by pyup.io – a service we use to keep our dependencies up to date. If that’s causing this issue, let me know and I’ll file a bug with the maintainer.

Behavior

As of the latest updates (assuming 2018-10-09), the lockfile entries for libsass and brotli contain markers for the extra args. Example:

        "libsass": {
            "hashes": [
                "sha256:2313f0e82de034eea59443c8f69420c60c55f7c07fd3b59ea7e7a108b36e9d86",
                "sha256:81d63f915d12bbff9931beac3eb6e20c17c40a0da06c3f0173bbacd6568c302c",
                "sha256:8731fb9b4d3151b82d46a4495c8e2b322705cacbcb963c4bfe51d8a5a0c016e7",
                "sha256:938518d827905c83d774a190cc6257b8183edea577485c20de7d49af5ccbeea6",
                "sha256:95109c996ea5cf598344971e7c50847930f1d5dc110b4fc989c047d3b63c0c92",
                "sha256:99d952ac9315af4494eedb1c38e13a16c7c49a6ca056262353e9433f086a1fe3",
                "sha256:9c87df48b541276cc8b03316ab558b4019f16e158786923950926a6ce756124a",
                "sha256:9f740659ec137cafbfd2298e77f21ceb1e40d30c578bd047e55e09da9220048e",
                "sha256:a1315327c134d5ec8f90b4185e1ff2369be0108733f1be0c2ae8ba629c514ef1",
                "sha256:bcbbb4fdd3117e00dc43594fe7e3b10fe17ada8932734287b2680fca18e118c9",
                "sha256:daa7ea2b3b24585cff907320d071992ffea3ba36c4523f90798f27d1c4a9ef66",
                "sha256:e0046d841469df8f578d7bbeb6859502cd4b09b9d559451a35392256423559ea",
                "sha256:e39800d946b9b11d956f02e158eeb85b86ae5b801e63c335f83609d2811b643a"
            ],
            "markers": "extra == 'libsass'",
            "version": "==0.15.1"
        },

This causes the following errors when installing dependencies:

Ignoring brotli: markers 'extra == "brotli"' don't match your environment                                                                                                                                         Looking in indexes: https://pypi.python.org/simple                                                                                                                                                                Ignoring libsass: markers 'extra == "libsass"' don't match your environment                                                                                                                                       Looking in indexes: https://pypi.python.org/simple

Note also that the entries that specify extras are totally fine in the lockfile:

        "django-static-precompiler": {
            "extras": [
                "libsass"
            ],
            "hashes": [
                "sha256:e4880e9bec5e64ea17f68f0787dc636e7c33a9dd68f497c5dd3733ca3e390bb2"
            ],
            "index": "pypi",
            "version": "==1.8.2"
        },

I’m happy to submit a PR if I get some pointers on where to begin. If it would be helpful for me to condense my pipfile to only relevant packages for reproduction, let me know.

[vmalloc]

Any idea when a version is expected to be released with a fix for this?

[slint]

Until the new version is released you can remove the “extra” markers manually from the Pipfile.lock before commiting it, e.g. via sed:

$ sed -i "/\"markers\": \"extra == /d" Pipfile.lock