@aws-cdk/aws-lambda-python: require-hashes error because of pipenv==2022.4.8

[avanderm]

Describe the bug

Bundling of poetry packages fails, since some packages do not receive hashes. Also referenced in #19232

Expected Behavior

1. Adds all the hashes to requirements.txt in the Docker build
2. Does not write the requirements.txt file into the local code folder

Current Behavior

Error notification:

ERROR: Hashes are required in --require-hashes mode, but they are missing from some requirements. Here is a list of those requirements along with the hashes their downloaded archives actually had. Add lines like these to your requirements
 files to prevent tampering. (If you did not enable --require-hashes manually, note that it turns on automatically when any package has a hash.)

Reproduction Steps

Poetry package generation in folder src relative to CDK project:

poetry new mypackage
poetry add aws-lambda-powertools
poetry install

File index.py in top level of Poetry package:

def handler(event, context):
  print(event)

Usage in CDK:

new PythonFunction(this, 'MyFunction', {
  entry: 'src/mypackage'
  runtime: Runtime.PYTHON_3_9,
});

Possible Solution

Overwrite the bundling Dockerfile to unpin the pipenv version solves the problem:

new PythonFunction(this, 'MyFunction', {
  bundling: {
    image: DockerImage.fromBuild('src/lambda-python'),
  },
  entry: 'src/mypackage'
  runtime: Runtime.PYTHON_3_9,
});

With Dockerfile found here

Additional Information/Context

No response

CDK CLI Version

2.37.1

Framework Version

No response

Node.js Version

v16.13.0

OS

Fedora release 35 (Thirty Five)

Language

Typescript

Language Version

TypeScript (3.9.7) | Python (3.9.5)

Other information

No response

[corymhall]

@avanderm why does unpinning the pipenv version solve the problem? Did they change this behavior in a more recent version?

[avanderm]

My mistake, turned out to be a Poetry lock issue, so will have to dig further in that direction. Closing this.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.