pipenv lock broken in 11.x

Hello

pipenv update seems broken since 11.x version for packages on our internal pypi (Nexus). We force a “pre-version” for a package with:

pipenv install 'pbr==3.1.2.dev54'

that is only available on our internal Nexus. The Pipfile is configured with

[[source]]

url = "http://nexus.server/repository/pypi/simple"
verify_ssl = false

This worked fine in pipenv < 11.

Now, it does not find it even if it is available (see in the error message) when generating the lock file:

$ pipenv install 'pbr==3.1.2.dev54'
Installing pbr==3.1.2.dev54…

Adding pbr==3.1.2.dev54 to Pipfile's [packages]…
Pipfile.lock not found, creating…
Locking [dev-packages] dependencies…
Locking [packages] dependencies…

Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches pbr==3.1.2.dev54,>=3.1.2.dev54
Tried: 0.5.2.5.g5b3e942, 3.1.2.dev54.linux-x86_64, 0.5.0, 0.5.1, 0.5.2, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.10, 0.5.11, 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.18, 0.5.19, 0.5.20, 0.5.21, 0.5.22, 0.5.23, 0.6, 0.7.0, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.9.0, 0.10.0, 0.10.0, 0.10.1, 0.10.1, 0.10.2, 0.10.2, 0.10.3, 0.10.3, 0.10.4, 0.10.4, 0.10.5, 0.10.5, 0.10.6, 0.10.6, 0.10.7, 0.10.7, 0.10.8, 0.10.8, 0.11.0, 0.11.0, 0.11.1, 0.11.1, 1.0.0, 1.0.0, 1.0.1, 1.0.1, 1.1.0, 1.1.0, 1.1.1, 1.1.1, 1.2.0, 1.2.0, 1.3.0, 1.3.0, 1.4.0, 1.4.0, 1.5.0, 1.5.0, 1.6.0, 1.6.0, 1.7.0, 1.7.0, 1.8.0, 1.8.0, 1.8.1, 1.8.1, 1.9.0, 1.9.0, 1.9.1, 1.9.1, 1.10.0, 1.10.0, 2.0.0, 2.0.0, 2.1.0, 2.1.0, 3.0.0, 3.0.0, 3.0.1, 3.0.1, 3.1.0, 3.1.0, 3.1.1, 3.1.1, 3.1.2.dev54, 3.1.2.dev54

We clearly see that 3.1.2.dev54 is available in this list. I do not want to depend on any other preversion than this package.

The generated Pipfile look good. Only the lock failed:

[[source]]
url = "http://nexus.server/repository/pypi/simple"
verify_ssl = false

[packages]
pbr = "==3.1.2.dev54"

[dev-packages]

Even with --pre it does not work:

$ pipenv install --pre 'pbr==3.1.2.dev54'
Installing pbr==3.1.2.dev54…
Requirement already satisfied: pbr==3.1.2.dev54 in /home/.../python3.5/site-packages

Adding pbr==3.1.2.dev54 to Pipfile's [packages]…
Pipfile.lock not found, creating…
Locking [dev-packages] dependencies…
Locking [packages] dependencies…

Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches pbr==3.1.2.dev54,>=3.1.2.dev54
Tried: 0.5.2.5.g5b3e942, 3.1.2.dev54.linux-x86_64, 0.5.0, 0.5.1, 0.5.2, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.10, 0.5.11, 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.18, 0.5.19, 0.5.20, 0.5.21, 0.5.22, 0.5.23, 0.6, 0.7.0, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.9.0, 0.10.0, 0.10.0, 0.10.1, 0.10.1, 0.10.2, 0.10.2, 0.10.3, 0.10.3, 0.10.4, 0.10.4, 0.10.5, 0.10.5, 0.10.6, 0.10.6, 0.10.7, 0.10.7, 0.10.8, 0.10.8, 0.11.0, 0.11.0, 0.11.1, 0.11.1, 1.0.0, 1.0.0, 1.0.1, 1.0.1, 1.1.0, 1.1.0, 1.1.1, 1.1.1, 1.2.0, 1.2.0, 1.3.0, 1.3.0, 1.4.0, 1.4.0, 1.5.0, 1.5.0, 1.6.0, 1.6.0, 1.7.0, 1.7.0, 1.8.0, 1.8.0, 1.8.1, 1.8.1, 1.9.0, 1.9.0, 1.9.1, 1.9.1, 1.10.0, 1.10.0, 2.0.0, 2.0.0, 2.1.0, 2.1.0, 3.0.0, 3.0.0, 3.0.1, 3.0.1, 3.1.0, 3.1.0, 3.1.1, 3.1.1, 3.1.2.dev54, 3.1.2.dev54

pipenv install --skip-lock does work, so this issue only seems to occur when generating the lock file.

$ pipenv --rm
$ pipenv install --skip-lock
Creating a virtualenv for this project…
Using /usr/bin/python3 (3.5.2) to create virtualenv…
⠋Already using interpreter /usr/bin/python3
Using base prefix '/usr'
New python executable in /home/.../bin/python3
Also creating executable in /home/.../bin/python
Installing setuptools, pip, wheel...done.

Virtualenv location: /home/.../toto-KPovq1sx
Installing dependencies from Pipfile…
  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 2/2 — 00:00:02
To activate this project's virtualenv, run the following:
 $ pipenv shell

$ pipenv lock                                                                                                                                                                                                  
Locking [dev-packages] dependencies…
Locking [packages] dependencies…

Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches pbr==3.1.2.dev54,>=3.1.2.dev54
Tried: 0.5.2.5.g5b3e942, 3.1.2.dev54.linux-x86_64, 0.5.0, 0.5.1, 0.5.2, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.10, 0.5.11, 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.18, 0.5.19, 0.5.20, 0.5.21, 0.5.22, 0.5.23, 0.6, 0.7.0, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.9.0, 0.10.0, 0.10.0, 0.10.1, 0.10.1, 0.10.2, 0.10.2, 0.10.3, 0.10.3, 0.10.4, 0.10.4, 0.10.5, 0.10.5, 0.10.6, 0.10.6, 0.10.7, 0.10.7, 0.10.8, 0.10.8, 0.11.0, 0.11.0, 0.11.1, 0.11.1, 1.0.0, 1.0.0, 1.0.1, 1.0.1, 1.1.0, 1.1.0, 1.1.1, 1.1.1, 1.2.0, 1.2.0, 1.3.0, 1.3.0, 1.4.0, 1.4.0, 1.5.0, 1.5.0, 1.6.0, 1.6.0, 1.7.0, 1.7.0, 1.8.0, 1.8.0, 1.8.1, 1.8.1, 1.9.0, 1.9.0, 1.9.1, 1.9.1, 1.10.0, 1.10.0, 2.0.0, 2.0.0, 2.1.0, 2.1.0, 3.0.0, 3.0.0, 3.0.1, 3.0.1, 3.1.0, 3.1.0, 3.1.1, 3.1.1, 3.1.2.dev54, 3.1.2.dev54

[mfwarren]

I’ve just encountered this as well - after updating pipenv.

$ pipenv install eth-keys==0.1.0b4
Installing eth-keys==0.1.0b4…

Adding eth-keys==0.1.0b4 to Pipfile's [packages]…
Pipfile.lock not found, creating…
Locking [dev-packages] dependencies…
Locking [packages] dependencies…

Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches eth-keys<0.2.0,==0.1.0b4,>=0.1.0b3
Tried: 0.1.0b1, 0.1.0b1, 0.1.0b2, 0.1.0b2, 0.1.0b3, 0.1.0b3, 0.1.0b4, 0.1.0b4, 0.2.0b1, 0.2.0b1, 0.2.0b2, 0.2.0b2, 0.2.0b3, 0.2.0b3

[kennethreitz]

We made some changes recently to this code that greatly increases our capabilities for private PyPI servers.