Pipenv lock changes markers in a non deterministic way
See original GitHub issueIssue description
I’m running pipenv version 2020.11.15 in a Gitlab CI pipeline.
I use pipenv lock
and then git diff Pipfile.lock
to see if the Pipfile.lock was updated, meaning that the version on the repository is not up-to-date anymore.
Occasionally, pipenv updates the lock file just changing the Python 4 specifier as follows:
diff --git a/Pipfile.lock b/Pipfile.lock
index c8d17c6..0228d56 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -225,7 +225,7 @@
"sha256:0a943902919f65c5684ac4e0154b1ad4fac6dcaa5d9f3426b732f1c8b5419be6",
"sha256:2bb1680aad211e3c9944dbce1d4ba09a989f04e238296c87fe2139faa26d655d"
],
- "markers": "python_version >= '3.6' and python_version < '4.0'",
+ "markers": "python_version >= '3.6' and python_version < '4'",
"version": "==5.8.0"
},
"jedi": {
@@ -881,7 +881,7 @@
"sha256:2f4da4594db7e1e110a944bb1b551fdf4e6c136ad42e4234131391e21eb5b0df",
"sha256:e7b021f7241115872f92f43c6508082facffbd1c048e3c6e2bb9c2a157e28937"
],
- "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4' and python_version < '4.0'",
+ "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4' and python_version < '4'",
"version": "==1.26.4"
},
"wcwidth": {
And sometimes it does the opposite thing, changing from python_version < '4'
to python_version < '4.0'
.
This of course breaks the pipeline, because there is difference in the Pipfile.lock, even though that difference is not significant.
Expected result
pipenv lock should change the lock file in a deterministic way, either always with python_version < '4'
or python_version < '4.0'
.
Issue Analytics
- State:
- Created 2 years ago
- Reactions:14
- Comments:25 (4 by maintainers)
Top Results From Across the Web
Advanced Usage of Pipenv - Read the Docs
This causes Pipenv to ignore changes to the Pipfile and (more importantly) prevents it from adding the current environment to Pipfile. lock ....
Read more >pipenv Documentation
Enables truly deterministic builds, while easily specifying only what you want. • Generates and checks file hashes for locked dependencies when installing from ......
Read more >Advanced Usage of Pipenv — pipenv 7.7.9 documentation
--skip-lock — Ignore the Pipfile.lock and install from the Pipfile . In addition, do not write out a Pipfile.lock reflecting changes ...
Read more >python - pipenv: why to run pipenv lock when lock file is ...
you do not move pipfile from testing environment to production - you always move pipfile.LOCK to the production environment, this makes sure ...
Read more >pipenv Changelog
Fix regression where ``path`` is not propagated to the ``Pipfile.lock``. ... requirement markers fresh (without lru_cache) to fix marker determinism issue.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Perhaps too early to tell, but I maybe am onto something about this issue – I removed the
lru_cache
decorators around the marker generation in requirementslib in this PR: https://github.com/pypa/pipenv/pull/5373I updated @dqkqd example Dockerfile to install this branch, and ran it three times without issue:
I also relocked pipenv 4 times and the markers only changed the first time suggesting that the branch that removes
lru_cache
makes it determinisitic. 🤞@matpompili and @jshwi please see: https://github.com/pypa/pipenv/issues/4967 TLDR: Pip 22.0.4 upgrade branch seems to make this deterministic again.
Closing this ticket now since we are already tracking it in the newer ticket.