Wheel cache ignores subdirectory URL fragment

[sbidoul]

Environment

• pip version: master
• Python version: any
• OS: any

Description

Pip wheel cache ignores subdirectory URL fragment. This can result in the wrong wheel being downloaded or installed.

Expected behavior

URLs with different subdirectory fragments must not result in the same cache entry.

How to Reproduce

1. cd to an empty directory
2. pip --cache-dir=$PWD/cache wheel --no-deps "git+https://github.com/OCA/mis-builder@c647390ee34d4b051ac1ae8094ebbf7fd222b08b#egg=odoo12-addon-mis_builder&subdirectory=setup/mis_builder"
3. verify that odoo12_addon_mis_builder-12.0.3.5.0.99.dev1-py3-none-any.whl is created
4. same command with a different subdirectory and egg fragments: pip --cache-dir=$PWD/cache wheel --no-deps "git+https://github.com/OCA/mis-builder@c647390ee34d4b051ac1ae8094ebbf7fd222b08b#egg=odoo12-addon-mis_builder_budget&subdirectory=setup/mis_builder_budget"
5. a new wheel should be created, but is not, due to the cache not taking into account the subdirectory fragment (nor the package name since it assumes no two URLs can point to the same package)

[sbidoul]

The fix can be done in one of those two places, or both:

1. adding the subdirectory fragment in key_parts here.
2. verifying that the canonicalized package name matches wheel.name in addition to supported tags here.

I think 2. is more robust and sufficient.

[chrahunt]

The comment in get_path_for_link states

Because there are M wheels for any one sdist, we provide a directory
to cache them in, and then consult that directory when looking up
cache hits.

which to me indicates the intent was one project (e.g. directory with setup.py) to one cache dir. In keeping with the same model we would want to add the subdirectory fragment to the cache key.

Adding a check for the wheel name would be good too as a sanity check. I think we can assert that the project name is not None at that point since otherwise we wouldn't have any candidates.

[sbidoul]

I made 1. and 2. in #7335