Provide --generate-hashes option to include hashes in requirements.txt output

[ncoghlan]

As described in #3057 (comment), emitting requirements.txt and then running pip-sync is much faster than running pipenv sync directly.

This speed increase comes from the fact that pip-sync is correctly checking for already installed packages, while pipenv sync doesn't yet do that.

However, the workaround has a problem, which is that if the pip-sync operation does need to install anything, then that installation won't check the artifact hashes, as those hashes aren't included in the requirements.txt output.

Supporting a pip-compile style --generate-hashes option to pipenv lock --requirements would allow the export to pip-sync (and other tools) to keep the expected hash information.

[whardier]

The documentation seems to suggest that by default pipenv lock --requirements would output hashes. I would also like to see all the related hashes for all ranged and explicit version specifiers.

[oz123]

That's probably easy to resolve:

diff --git a/pipenv/core.py b/pipenv/core.py
index 361e21ee..ba265bc8 100644
--- a/pipenv/core.py
+++ b/pipenv/core.py
@@ -798,8 +798,10 @@ def do_install_dependencies(
             get_source_list(project, pypi_mirror=pypi_mirror)
         )
         index_args = " ".join(index_args).replace(" -", "\n-")
+        include_hashes=True
+        import re
         deps = [
-            req.as_line(sources=False, include_hashes=include_hashes) for req in deps_list
+            re.sub(" --hash", " \\\n --hash", req.as_line(sources=False, include_hashes=True)) for req in deps_list
         ]
         click.echo(index_args)
         click.echo("\n".join(sorted(deps)))

[matteius]

This is resolved when using the fairly new pipenv requirements command.