pipenv install --skip-lock should not expand environment variables in packages section

[uranusjr]

From #3048. I believe this is unintended?

[techalchemy]

Absolutely.

[techalchemy]

This is mainly a security concern I guess, but should we consider expanding variables in packages? It's not like people don't want it

[uranusjr]

I agree this is worth considering, if Kenneth says yes.

[kirel]

What did Kenneth say?

[uranusjr]

No words from him, but @techalchemy I recall we had a similar discussion on this a while ago. The conclusion as I remember (might be me imagining) is essentially the same, i.e. don’t want to support this due to security concerns?

[giallu]

I'd actually need this...
I am deploying to heroku an app with a dependency I need to download from a private git repo; so I would generate an access token for my repository and do something like:

[packages]
"mypackage" = {ref = "master", git = "git+https://user${ACCESS_TOKEN}@github.com/nsa/secret.git"}

There is probably a better way to add this (any suggestions appreciated) but it looks like a fairly common scenario, so I am wondering what are the security concerns preventing this to be added.

[matteius]

--skip-lock is deprecated at this time as we do not recommend bypassing the lockfile, so I think we will plan to not fix this.