Private repos do not update even though hash value changed

[DanielSwain]

Background

I have a private library housed as a private repo on BitBucket that I've successfully installed on my dev machine using pipenv. This yields the following line in the Pipfile:
private-repo-name = {ref = "master", git = "ssh://[email protected]/our_organization_name/private-repo-name.git"}

Issue description

On my dev machine, after pushing an update to the private library/repo, I do python3 -m pipenv update, and the hash in Pipfile.lock for the private repo is updated. However, when I do python3 -m pipenv sync in production, the library is not updated (public libraries ARE updated correctly when following this procedure). In order to have the latest version of the private library installed, it is necessary to first remove the venv and then execute sync.

Expected result

The private library should be updated on production when python3 -m pipenv sync is executed against a Pipfile.lock file that was successfully updated on a dev machine to include a new hash value for the private library.

Actual result

The private library is NOT updated on production after executing python3 -m pipenv sync on an updated Pipfile.lock file.

Steps to replicate

Install a private library that was created following the docs for creating reusable apps. Update the private library, push the changes to the private repo, and then do python3 -m pipenv update on the dev machine in order to update the hash value in Pipfile.lock. On production, pull the latest Pipfile.lock and then do python3 -m pipenv sync. Check the site packages that are installed in the venv and see that the private repo has not been updated.

---

Pipenv version: '2023.7.11'

Pipenv location: '/usr/local/lib/python3.8/dist-packages/pipenv'

Python location: '/usr/bin/python3'

OS Name: 'posix'

User pip version: '23.2'

user Python installations found:

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.8.10',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '5.10.102.1-microsoft-standard-WSL2',
 'platform_system': 'Linux',
 'platform_version': '#1 SMP Wed Mar 2 00:30:59 UTC 2022',
 'python_full_version': '3.8.10',
 'python_version': '3.8',
 'sys_platform': 'linux'}

System environment variables:

• SHELL
• PYENV_HOOK_PATH
• PYENV_SHELL
• SUDO_GID
• SUDO_COMMAND
• SUDO_USER
• PYENV_VERSION
• PWD
• PYENV_VIRTUALENV_INIT
• LOGNAME
• HOME
• LANG
• LS_COLORS
• PYENV_DIR
• WORKON_HOME
• LESSCLOSE
• TERM
• LESSOPEN
• USER
• SHLVL
• PYENV_ROOT
• PATH
• SUDO_UID
• MAIL
• OLDPWD
• PYTHONDONTWRITEBYTECODE
• PIP_DISABLE_PIP_VERSION_CHECK
• DJANGO_SETTINGS_MODULE
• PYTHONFINDER_IGNORE_UNSUPPORTED

[matteius]

@DanielSwain would you be willing to check this behavior with: #5793

[matteius]

@DanielSwain Could this be rechecked on 2023.8.19?

[matteius]

Does the lock file have a specific hash defined for the repository? I think that it would not change unless you re-locked.

[DanielSwain]

@matteius I can confirm that private repos update correctly now and the hash value is back in the Pipfile.lock file. Everything worked correctly when I synced the production environment. Thanks for the great work!