Pants 2.19 fails to download WHLs with URL-escaped chars

[lowvoltage]

Describe the bug
Pants 2.19 fails to download WHL files hosted on URLs that contain URL-escaped characters. This applies to both URLs already present in the lockfile and to URLs retrieved during generate-lockfiles.

For example, instead of:
https://download.pytorch.org/whl/cpu/torch-2.0.1%2Bcpu-cp311-cp311-linux_x86_64.whl
it attempts (and fails) to download:
https://download.pytorch.org/whl/cpu/torch-2.0.1+cpu-cp311-cp311-linux_x86_64.whl

Seems to be related to the v2.1.148 PEX version, as downgrading to v2.1.137 resolves the issue

Pants version
2.19.0

OS
Both MacOS and Linux

Additional info
Minimalist example to reproduce:

python_requirement(
    requirements=["torch==2.0.1+cpu"],
)

[GLOBAL]
pants_version = "2.19.0"

backend_packages = [
  "pants.backend.python",
]

[python]
interpreter_constraints = ["==3.11.*"]
enable_resolves = true

[python-repos]
find_links = [
    "https://download.pytorch.org/whl/torch_stable.html",
]

# Workaround: Downgrade to a previous PEX version
#[pex-cli]
#known_versions = [
#  "v2.1.137|macos_arm64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329",
#  "v2.1.137|macos_x86_64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329",
#  "v2.1.137|linux_x86_64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329",
#  "v2.1.137|linux_arm64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329"
#]
#version = "v2.1.137"

[cburroughs]

I tried to bisect with:

$ python3.10 -m pex.cli lock create --interpreter-constraint $'CPython==3.11.*' --style=universal --pip-version=23.1.2 --resolver-version pip-2020-resolver --find-links=https://download.pytorch.org/whl/torch_stable.html  "torch==2.0.1+cpu" -o tmp/tmp.lock

and ended up at pex-tool/pex@45eea4b

[tgolsson]

Thanks @cburroughs. Wonder if this is something Pants does wrong when invoking Pex or if it's a Pex issue. I see a few added unquote f.ex., which would lead to the issues observed if not quoted on-use.

For clarity, can you show the same regression with extra-indexes as well? Or is this find-links specific code paths?

[cburroughs]

For clarity, can you show the same regression with extra-indexes as well? Or is this find-links specific code paths?

If someone knows of a package on PyPi that uses the + syntax I'm happy to try to concoct a test, but I didn't know that was valid before today.

[tgolsson]

It's a local version specifier, and I don't think PyPi would accept them -- they're meant for distro patches, primarily. Torch using them for API spec is... a stretch, semantically. I did a test myself using torch's extra index and couldn't repro, so seems like find-links is the issue.