Pipenv仅识别Pipfile首个源的问题及临时解决办法

问题现象 #

• 当前运行环境：Python 3.10.12，先后测试过pipenv 2022.4.8、2023.11.15版本，问题均复现
• Pipfile配置双源（官方PyPI+公司私有Artifactory源），并为每个包指定了对应源索引，配置示例如下：

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[[source]]
name = "artifactory"
url = "some private URL my company uses"
verify_ssl= true

[dev-packages]
package1 = {version = "==2.2.10", index = "artifactory"}

[packages]
protobuf = {version = "==4.21.6", index = "pypi"}
grpcio = {version = "==1.54.0", index = "pypi"}
grpcio-tools = {version = "==1.54.0", index = "pypi"}
package2 = {version = "==4.20.69", index = "artifactory"}
etc...

• 执行pipenv lock时出现源顺序相关报错：
  • 若源顺序为先PyPI后Artifactory，报错No matching distribution found for package1 (from versions: none)
  • 若调换源顺序为先Artifactory后PyPI，报错No matching distribution found for protobuf (from versions: none)
• 已尝试的无效方案：仅保留单个源可正常构建；更换不同pipenv/Python版本；移除包的索引指定，问题仍存在

临时解决方案 #

降级pipenv至2022.1.8版本，可正常生成Pipfile.lock

排查进展 #

问题原因正在排查中，初步判断可能与GitHub issue #5021相关

内容的提问来源于stack exchange，提问作者David Li