Incorrect index in lockfile

Issue description

When using a custom index for a package that is also on PyPI, but with different versions, it uses the custom index for the version (which is the higher version, so this is correct), but the lock file tags it as coming from the PyPI index. The version that is locked does not exist on the pypi index, and the PyPI versions do not exist on the custom index.

Expected result

I expected it to get the latest version, and annotate the lockfile with the correct index that the version was retrieved from.

Actual result

Locking works cleanly, but produced the odd output in the lockfile.

Steps to replicate

Use this Pipfile

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[[source]]
name = "aspiredu"
verify_ssl = true
url = "https://pypi.fury.io/OHXIw-9Umgf3jlbpG5ULSp97w456Q/aspiredu/"

[dev-packages]

[packages]
django-enumfields = "*"

[requires]
python_version = "3.7"

to lock and get this Pipfile.lock

{
    "_meta": {
        "hash": {
            "sha256": "8e1f91149b67ec93c8a959eb66c89860a7dcfba35b07c058890607a0bc16eb7c"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.7"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.org/simple",
                "verify_ssl": true
            },
            {
                "name": "aspiredu",
                "url": "https://pypi.fury.io/OHXIw-9Umgf3jlbpG5ULSp97w456Q/aspiredu/",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "django-enumfields": {
            "hashes": [
                "sha256:b32faacf10ac20201dc2910a5f440d8132e7cae80e689e14a97bd1394e3a8dd4"
            ],
            "index": "pypi",
            "version": "==0.10.1+aspiredu1"
        }
    },
    "develop": {}
}

---

$ pipenv --support

Pipenv version: '2018.11.14'

Pipenv location: '/home/ryan/.local/lib/python3.6/site-packages/pipenv'

Python location: '/home/ryan/.pyenv/versions/3.6.6/bin/python3.6'

Python installations found:

• 3.7.1: /home/ryan/.pyenv/versions/3.7.1/bin/python3
• 3.7.1: /home/ryan/.pyenv/versions/3.7.1/bin/python3.7m
• 3.7.0: /home/ryan/.pyenv/versions/3.7.0/bin/python3
• 3.7.0: /home/ryan/.pyenv/versions/3.7.0/bin/python3.7m
• 3.6.7: /home/ryan/.pyenv/versions/3.6.7/bin/python3
• 3.6.7: /home/ryan/.pyenv/versions/3.6.7/bin/python3.6m
• 3.6.6: /home/ryan/.pyenv/versions/3.6.6/bin/python3
• 3.6.6: /home/ryan/.pyenv/versions/3.6.6/bin/python3.6m
• 3.6.6: /usr/bin/python3
• 3.6.6: /usr/bin/python3.6m
• 2.7.15rc1: /usr/bin/python2.7

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.6.6',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '4.15.0-38-generic',
 'platform_system': 'Linux',
 'platform_version': '#41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018',
 'python_full_version': '3.6.6',
 'python_version': '3.6',
 'sys_platform': 'linux'}

System environment variables:

• CLUTTER_IM_MODULE
• LS_COLORS
• LESSCLOSE
• XDG_MENU_PREFIX
• LANG
• GDM_LANG
• DISPLAY
• QT_STYLE_OVERRIDE
• COLORTERM
• PYENV_VIRTUALENV_INIT
• XDG_VTNR
• SSH_AUTH_SOCK
• MANDATORY_PATH
• XDG_SESSION_ID
• XDG_GREETER_DATA_DIR
• USER
• DESKTOP_SESSION
• QT4_IM_MODULE
• TEXTDOMAINDIR
• GNOME_TERMINAL_SCREEN
• DEFAULTS_PATH
• QT_QPA_PLATFORMTHEME
• PWD
• HOME
• TEXTDOMAIN
• SSH_AGENT_PID
• QT_ACCESSIBILITY
• XDG_SESSION_TYPE
• XDG_DATA_DIRS
• XDG_SESSION_DESKTOP
• GTK_MODULES
• TERM
• SHELL
• VTE_VERSION
• XDG_SEAT_PATH
• QT_IM_MODULE
• XMODIFIERS
• IM_CONFIG_PHASE
• XDG_CURRENT_DESKTOP
• GPG_AGENT_INFO
• GNOME_TERMINAL_SERVICE
• XDG_SEAT
• SHLVL
• PYENV_SHELL
• LANGUAGE
• GDMSESSION
• GNOME_DESKTOP_SESSION_ID
• LOGNAME
• DBUS_SESSION_BUS_ADDRESS
• XDG_RUNTIME_DIR
• XAUTHORITY
• XDG_SESSION_PATH
• XDG_CONFIG_DIRS
• PATH
• SESSION_MANAGER
• LESSOPEN
• GTK_IM_MODULE
• OLDPWD
• _
• PIP_DISABLE_PIP_VERSION_CHECK
• PYTHONDONTWRITEBYTECODE
• PIP_SHIMS_BASE_MODULE
• PIP_PYTHON_PATH
• PYTHONFINDER_IGNORE_UNSUPPORTED

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /home/ryan/bin:/home/ryan/.local/bin:/home/ryan/.pyenv/plugins/pyenv-virtualenv/shims:/home/ryan/.pyenv/shims:/home/ryan/.pyenv/bin:/home/ryan/.local/bin:/home/ryan/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
• SHELL: /bin/bash
• LANG: en_US.UTF-8
• PWD: /home/ryan/Code/aspiredu/pipenv-indices

---

Contents of Pipfile (‘/home/ryan/Code/aspiredu/pipenv-indices/Pipfile’):

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[[source]]
name = "aspiredu"
verify_ssl = true
url = "https://pypi.fury.io/OHXIw-9Umgf3jlbpG5ULSp97w456Q/aspiredu/"

[dev-packages]

[packages]
django-enumfields = "*"

[requires]
python_version = "3.7"

Contents of Pipfile.lock (‘/home/ryan/Code/aspiredu/pipenv-indices/Pipfile.lock’):

{
    "_meta": {
        "hash": {
            "sha256": "8e1f91149b67ec93c8a959eb66c89860a7dcfba35b07c058890607a0bc16eb7c"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.7"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.org/simple",
                "verify_ssl": true
            },
            {
                "name": "aspiredu",
                "url": "https://pypi.fury.io/OHXIw-9Umgf3jlbpG5ULSp97w456Q/aspiredu/",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "django-enumfields": {
            "hashes": [
                "sha256:b32faacf10ac20201dc2910a5f440d8132e7cae80e689e14a97bd1394e3a8dd4"
            ],
            "index": "pypi",
            "version": "==0.10.1+aspiredu1"
        }
    },
    "develop": {}
}

[nickwilliams-eventbrite]

I’m also seeing this problem. Here’s a bit more info:

Our project Pipfiles have two sources at the top:

[[source]]
url = "https://our.jenkins.server/job/wheelhouse-index/Indexes/16.04/simple/"
verify_ssl = true
name = "our_wheelhouse"

[[source]]
url = "https://pypi.python.org/simple"
verify_ssl = true
name = "pypi"

Our private wheelhouse holds closed-source projects that we don’t release publicly. When we run pipenv lock on a project, every dependency in the Pipfile.lock ends up having "index": "our_wheelhouse" in it, including all the open source projects that actually come from PyPi. This is despite the fact that we don’t mirror anything in our private wheelhouse: It contains only our closed-source projects.

The order of the [[source]]s does not matter. If we put PyPi first, our private wheelhouse is still listed as the index for every dependency, even those on PyPi.

Interestingly, it doesn’t seem to affect anything. Future installs using the lock file still work fine. There are no errors. But this is clearly not accurate data in the lock file, and I’m concerned that, in future pipenv versions, it could break something.

[fridex]

Observed this a few times as well. This behavior breaks integration with other tools in our cases (e.g. micropipenv).