Filter available distributions using hash declarations from constraints files

[q0w]

Closes #9243

is_pinned implementation is fixed according to #10625 (comment).

[uranusjr]

Awesome, thanks a lot !

[uranusjr]

Hmm, tests are failing. Does this break existing code…? It seems like the current hash (and specifier) forwarding logic is not good enough. Maybe we need to somehow merge the values, instead of simply replacing?

[q0w]

I tested this against examples from #9243 and #8792

[q0w]

Yes, it should somehow merge values or check if they are not None.

[q0w]

@uranusjr fixed. What about #10625 (comment)

In provider.py, there’s a pinned = any(op[:2] == "==" for op in operators) that can be tightened up. This one just offers a “hint” to the resolver so the current logic is not very careful with the definition of “pinned”, but since we have a proper implementation now it’s a good idea to reuse it.

[uranusjr]

You can also fix that in this PR if you want to (just use your is_pinn for that), but this looks for me as-is.

[pradyunsg]

Thanks @q0w! ^>^

[graingert]

when running with pip 0c28452 I still get:

pip install -c requirements.txt black
Collecting black
ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    black from [files.pythonhosted.org/packages/a5/59/bd6d44da2b364fd2bd7a0b2ce2edfe200b79faad1cde14ce5ef13d504393/black-22.1.0-py3-none-any.whl#sha256=3524739d76b6b3ed1132422bf9d82123cd1705086723bc3e235ca39fd21c667d](https://files.pythonhosted.org/packages/a5/59/bd6d44da2b364fd2bd7a0b2ce2edfe200b79faad1cde14ce5ef13d504393/black-22.1.0-py3-none-any.whl#sha256=3524739d76b6b3ed1132422bf9d82123cd1705086723bc3e235ca39fd21c667d)

even though I have 3524739d76b6b3ed1132422bf9d82123cd1705086723bc3e235ca39fd21c667d in my requirements.txt

see https://github.com/graingert/constraints-demo/runs/5568222864?check_suite_focus=true#step:5:8

[q0w]

@graingert I tried your setup project with pip install git+https://github.com/pypa/pip.git@main and its all OK

pip install git+https://github.com/pypa/pip.git@main
pip install -c requirements.txt black

[graingert]

@graingert I tried your setup project with pip install git+https://github.com/pypa/pip.git@main and its all OK

pip install git+https://github.com/pypa/pip.git@main
pip install -c requirements.txt black

thanks for looking into this, I'm sorry for the noise on this PR as looking into this further it seems to happen on both the legacy and regular resolver and so unrelated to this PR - I just happened to be using an alpha build of python to try out your new fix!

when I run with the legacy resolver I get:

$ pip install --use-deprecated=legacy-resolver -c requirements.txt black                               
Ignoring black: markers 'python_full_version >= "3.6.2"' don't match your environment
Ignoring click: markers 'python_version >= "3.6" and python_full_version >= "3.6.2"' don't match your environment
Ignoring colorama: markers 'python_version >= "3.6" and python_full_version >= "3.6.2" and platform_system == "Windows"' don't match your environment
Ignoring mypy-extensions: markers 'python_full_version >= "3.6.2"' don't match your environment
Ignoring pathspec: markers 'python_full_version >= "3.6.2"' don't match your environment
Ignoring platformdirs: markers 'python_version >= "3.7" and python_full_version >= "3.6.2"' don't match your environment
Ignoring tomli: markers 'python_version >= "3.7" and python_full_version >= "3.6.2"' don't match your environment
Collecting black
ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    black from https://files.pythonhosted.org/packages/a5/59/bd6d44da2b364fd2bd7a0b2ce2edfe200b79faad1cde14ce5ef13d504393/black-22.1.0-py3-none-any.whl#sha256=3524739d76b6b3ed1132422bf9d82123cd1705086723bc3e235ca39fd21c667d

which is related to how the markers are evaluated:

Python 3.11.0a5 (main, Feb 12 2022, 17:11:59) [GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from packaging.markers import Marker
>>> Marker("python_full_version > '3.6.2'")
<Marker('python_full_version > "3.6.2"')>
>>> Marker("python_full_version > '3.6.2'").evaluate({"python_full_version": "3.11.0a5"})
False
>>> Marker("python_full_version > '3.6.2'").evaluate({"python_full_version": "3.11"})
True
>>> 

[pradyunsg]

As far as I understand, this introduced a regression, see #11019.