git username replaced with **** redaction in lockfile for git+ssh direct references

[dquig]

To reproduce:

python -m pex.cli lock create \
 "ansicolors@ git+ssh://[email protected]/jonathaneunice/colors.git@c965f5b9103c5bd32a1572adb8024ebe83278fb0" \
  | jq .

{
  "allow_builds": true,
  "allow_prereleases": false,
  "allow_wheels": true,
  "build_isolation": true,
  "constraints": [],
  "locked_resolves": [
    {
      "locked_requirements": [
        {
          "artifacts": [
            {
              "algorithm": "sha256",
              "hash": "feca938276d1a7ed8c4c1a7a443e8c00d927fe4b70d9081e4f560fd8e02e8119",
              "url": "git+ssh://****@github.com/jonathaneunice/colors.git@c965f5b9103c5bd32a1572adb8024ebe83278fb0"
            }
          ],
          "project_name": "ansicolors",
          "requires_dists": [],
          "requires_python": null,
          "version": "1.1.8"
        }
      ],
      "platform_tag": [
        "cp27",
        "cp27mu",
        "manylinux_2_31_x86_64"
      ]
    }
  ],
  "path_mappings": {},
  "pex_version": "2.1.105",
  "pip_version": "20.3.4-patched",
  "prefer_older_binary": false,
  "requirements": [
    "ansicolors"
  ],
  "requires_python": [],
  "resolver_version": "pip-legacy-resolver",
  "style": "strict",
  "target_systems": [],
  "transitive": true,
  "use_pep517": null
}

[benjyw]

Relevant bit where pip redacts this: https://github.com/pypa/pip/blob/main/src/pip/_internal/utils/misc.py#L456

[engnatha]

I filed pantsbuild/pants#15410 a while ago, but this is the same issue for me. It's blocking me cloning a repo in my CI but oddly works locally fine.

pip-tools, which we are currently using, does not do this behavior.

[jsirois]

Alright @dquig and @engnatha the fix for this is released in Pex 2.1.107 and Pants 2.15.0.dev3 should have that fix with the PR here: pantsbuild/pants#17081

If either of you don't have a workaround (it seems like you do @engnatha) and need the upgrade to Pex 2.1.107 cherry-picked back to Pants 2.14 or 2.13 let me know.