pypa / pipfile

Other
3.24k stars 145 forks source link

Pipfile.lock() is not idempotent #125

Open GPHemsley opened 4 years ago

GPHemsley commented 4 years ago

https://github.com/pypa/pipfile/blob/7d7c3126dcfc519d7250c3ed4f311f8e58c3197c/pipfile/api.py#L128-L133

Because line 130 is not using copy to copy self.data, the subsequent lines are mutating self.data, which is adding self.hash to the value self.data.

This causes every subsequent call to Pipfile.lock() to hash the hash, which means the hash changes every time.

import pipfile

p = pipfile.load("Pipfile")

hash_before = p.hash
print(hash_before)

p.lock()

hash_after = p.hash
print(hash_after)

print(hash_before == hash_after)