Don't write build artifacts to cwd

- Fixes #3106

Signed-off-by: Dan Ryan <dan@danryan.co>

news/3106.bugfix.rst

@@ -0,0 +1 @@
+Pipenv will avoid leaving build artifacts in the current working directory.

pipenv/utils.py

@@ -295,7 +295,11 @@ class PipCommand(Command):
  hashes = {
  ireq: pypi._hash_cache.get_hash(ireq.link)
  for ireq in constraints if getattr(ireq, "link", None)
- and ireq.link.is_artifact and not is_pypi_url(ireq.link.url)
+ # We can only hash artifacts, but we don't want normal pypi artifcats since the
+ # normal resolver handles those
+ and ireq.link.is_artifact and not is_pypi_url(ireq.link.url) and not
+ # We also don't want to try to hash directories as this will fail (editable deps)
+ (ireq.link.scheme == "file" and os.path.isdir(ireq.link.path))
  }
  try:
  results = resolver.resolve(max_rounds=environments.PIPENV_MAX_ROUNDS)

pipenv/vendor/requirementslib/utils.py

@@ -186,7 +186,14 @@ def ensure_setup_py(base_dir):
  if not base_dir:
  base_dir = create_tracked_tempdir(prefix="requirementslib-setup")
  base_dir = Path(base_dir)
+ if base_dir.exists() and base_dir.name == "setup.py":
+ base_dir = base_dir.parent
+ elif not (base_dir.exists() and base_dir.is_dir()):
+ base_dir = base_dir.parent
+ if not (base_dir.exists() and base_dir.is_dir()):
+ base_dir = base_dir.parent
  setup_py = base_dir.joinpath("setup.py")
+
  is_new = False if setup_py.exists() else True
  if not setup_py.exists():
  setup_py.write_text(u"")