Issue with installing social-core package

Overview

social-core package relies on two versions of OpenID library - python-openid for Python 2 and python3-openid for Python 3. When installing the package with pipenv under Python 3 it installs the incorrect dependency (python-openid).

Steps to reproduce

1. Create new environment pipenv --python 3.6.
2. Install social-core with pipenv install social-auth-core.
3. Run pipenv run python and type from openid.association import Association as OpenIdAssociation. It should print an exception because of incorrect version of OpenID installed.
4. Examine Pipfile.lock - it locks to a python-openid library instead of python3-openid:

"python-openid": {
  "hashes": [
    "sha256:92c51c3ecec846cbec4aeff11f9ff47303d4a63f93b0e6ac0ec02a091fed70ef",
    "sha256:c2d133e47e0a7705c9272eef00d7a09c174f5bf17a127fed8e2c6499556cc782"
  ],
  "version": "==2.2.5"
},

1. Examine pipenv graph - it reports python-openid==2.2.5 as a root dependency (although it is not in Pipfile) and it gives ? as python3-openid installed version:

python-openid==2.2.5
social-auth-core==1.4.0
  - defusedxml [required: >=0.5.0rc1, installed: ?]
  - oauthlib [required: >=1.0.3, installed: 2.0.4]
  - PyJWT [required: >=1.4.0, installed: 1.5.3]
  - python3-openid [required: >=3.0.10, installed: ?]
  - requests [required: >=2.9.1, installed: 2.18.4]
    - certifi [required: >=2017.4.17, installed: 2017.7.27.1]
    - chardet [required: <3.1.0,>=3.0.2, installed: 3.0.4]
    - idna [required: <2.7,>=2.5, installed: 2.6]
    - urllib3 [required: >=1.21.1,<1.23, installed: 1.22]
  - requests-oauthlib [required: >=0.6.1, installed: 0.8.0]
    - oauthlib [required: >=0.6.2, installed: 2.0.4]
    - requests [required: >=2.0.0, installed: 2.18.4]
      - certifi [required: >=2017.4.17, installed: 2017.7.27.1]
      - chardet [required: <3.1.0,>=3.0.2, installed: 3.0.4]
      - idna [required: <2.7,>=2.5, installed: 2.6]
      - urllib3 [required: >=1.21.1,<1.23, installed: 1.22]
  - six [required: >=1.10.0, installed: 1.11.0]

Environment

The issue is reproducible both on my local machine (OS X High Sierra, Python 3.6.1) and also while deploying to a Heroku instance.

$ pipenv --version
pipenv, version 8.2.6

Pip

After uninstalling all dependencies from local environment and installing social-core through pip (pip install social-auth-core) the correct version of the library is installed. pipenv graph output:

social-auth-core==1.4.0
  - defusedxml [required: >=0.5.0rc1, installed: 0.5.0]
  - oauthlib [required: >=1.0.3, installed: 2.0.4]
  - PyJWT [required: >=1.4.0, installed: 1.5.3]
  - python3-openid [required: >=3.0.10, installed: 3.1.0]
    - defusedxml [required: Any, installed: 0.5.0]
  - requests [required: >=2.9.1, installed: 2.18.4]
    - certifi [required: >=2017.4.17, installed: 2017.7.27.1]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.7, installed: 2.6]
    - urllib3 [required: >=1.21.1,<1.23, installed: 1.22]
  - requests-oauthlib [required: >=0.6.1, installed: 0.8.0]
    - oauthlib [required: >=0.6.2, installed: 2.0.4]
    - requests [required: >=2.0.0, installed: 2.18.4]
      - certifi [required: >=2017.4.17, installed: 2017.7.27.1]
      - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
      - idna [required: >=2.5,<2.7, installed: 2.6]
      - urllib3 [required: >=1.21.1,<1.23, installed: 1.22]
  - six [required: >=1.10.0, installed: 1.11.0]

Pipfile

[[source]]
url = "https://pypi.python.org/simple"
verify_ssl = true
name = "pypi"

[packages]
"social-auth-core" = "*"

[dev-packages]

[requires]
python_version = "3.6"

Pipfile.lock

{
    "_meta": {
        "hash": {
            "sha256": "11f43d77c251cf272f5343fcb53386bb885a600608711bf5fcca0e3ae5872878"
        },
        "host-environment-markers": {
            "implementation_name": "cpython",
            "implementation_version": "3.6.1",
            "os_name": "posix",
            "platform_machine": "x86_64",
            "platform_python_implementation": "CPython",
            "platform_release": "17.0.0",
            "platform_system": "Darwin",
            "platform_version": "Darwin Kernel Version 17.0.0: Thu Aug 24 21:48:19 PDT 2017; root:xnu-4570.1.46~2/RELEASE_X86_64",
            "python_full_version": "3.6.1",
            "python_version": "3.6",
            "sys_platform": "darwin"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.6"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.python.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "certifi": {
            "hashes": [
                "sha256:54a07c09c586b0e4c619f02a5e94e36619da8e2b053e20f594348c0611803704",
                "sha256:40523d2efb60523e113b44602298f0960e900388cf3bb6043f645cf57ea9e3f5"
            ],
            "version": "==2017.7.27.1"
        },
        "chardet": {
            "hashes": [
                "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691",
                "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae"
            ],
            "version": "==3.0.4"
        },
        "idna": {
            "hashes": [
                "sha256:8c7309c718f94b3a625cb648ace320157ad16ff131ae0af362c9f21b80ef6ec4",
                "sha256:2c6a5de3089009e3da7c5dde64a141dbc8551d5b7f6cf4ed7c2568d0cc520a8f"
            ],
            "version": "==2.6"
        },
        "oauthlib": {
            "hashes": [
                "sha256:514e293cb356dd53d596692207d48d9231b997995c9a4167eefa868583d74d13"
            ],
            "version": "==2.0.4"
        },
        "pyjwt": {
            "hashes": [
                "sha256:a4e5f1441e3ca7b382fd0c0b416777ced1f97c64ef0c33bfa39daf38505cfd2f",
                "sha256:500be75b17a63f70072416843dc80c8821109030be824f4d14758f114978bae7"
            ],
            "version": "==1.5.3"
        },
        "python-openid": {
            "hashes": [
                "sha256:92c51c3ecec846cbec4aeff11f9ff47303d4a63f93b0e6ac0ec02a091fed70ef",
                "sha256:c2d133e47e0a7705c9272eef00d7a09c174f5bf17a127fed8e2c6499556cc782"
            ],
            "version": "==2.2.5"
        },
        "requests": {
            "hashes": [
                "sha256:6a1b267aa90cac58ac3a765d067950e7dbbf75b1da07e895d1f594193a40a38b",
                "sha256:9c443e7324ba5b85070c4a818ade28bfabedf16ea10206da1132edaa6dda237e"
            ],
            "version": "==2.18.4"
        },
        "requests-oauthlib": {
            "hashes": [
                "sha256:50a8ae2ce8273e384895972b56193c7409601a66d4975774c60c2aed869639ca",
                "sha256:883ac416757eada6d3d07054ec7092ac21c7f35cb1d2cf82faf205637081f468"
            ],
            "version": "==0.8.0"
        },
        "six": {
            "hashes": [
                "sha256:832dc0e10feb1aa2c68dcc57dbb658f1c7e65b9b61af69048abc87a2db00a0eb",
                "sha256:70e8a77beed4562e7f14fe23a786b54f6296e34344c23bc42f07b15018ff98e9"
            ],
            "version": "==1.11.0"
        },
        "social-auth-core": {
            "hashes": [
                "sha256:8a1b83995e891989195ef34ad46bd8fd6e98d8bc4510d3e5b34f7c24acc794c4",
                "sha256:c5c150e048a81bc292f57f6f05cad0a13d5a29589b3e085fcf39007c2312223b",
                "sha256:f83005f42cf3d870b49a3c9fddc2b2e8ec28fbb367626a304190b52e151e059d"
            ],
            "version": "==1.4.0"
        },
        "urllib3": {
            "hashes": [
                "sha256:06330f386d6e4b195fbfc736b297f58c5a892e4440e54d294d7004e3a9bbea1b",
                "sha256:cc44da8e1145637334317feebd728bd869a35285b93cbb4cca2577da7e62db4f"
            ],
            "version": "==1.22"
        }
    },
    "develop": {}
}

Any feedback on how to workaround the issue would be greatly appreciated. Thank you! ❤️

[robgolding]

I was still experiencing this issue myself, until I realised that pipenv was actually installed globally under Python 2.7. Uninstalling it and re-installing using pip3 fixed it for me!

[voiddragon]

pipenv lock --clear seems to have fixed the issue.

Thanks!!