Fix: SSH VCS URLs without branch ref being corrupted

[matteius]

Summary

Fixes #6076

Problem

When installing a git dependency over SSH without specifying a branch/ref (e.g., git+ssh://[email protected]/user/repo.git#egg=package), the URL was being incorrectly parsed. The @ symbol in [email protected] was being treated as a branch/ref separator, resulting in corrupted Pipfile.lock entries like:

"git": "git+ssh://git"

instead of the correct:

"git": "git+ssh://[email protected]/user/repo.git"

This caused pip to fail with errors like:

fatal: 'github.com/user/repo.git' does not appear to be a git repository

Root Cause

In pipenv/project.py, the generate_package_pipfile_entry() function was using rsplit("@", 1) to extract the branch/ref from VCS URLs. This incorrectly split on the @ in SSH URLs like [email protected], treating github.com/user/repo.git as the ref and git+ssh://git as the URL.

Solution

The fix checks if the @ symbol is in the path part of the URL (indicating a branch/ref) rather than in the netloc (hostname) part before splitting. This matches the behavior of the existing normalize_vcs_url() function in pipenv/utils/dependencies.py.

Changes

1. pipenv/project.py: Updated generate_package_pipfile_entry() to use urllib.parse.urlparse() to check if @ is in the path before treating it as a ref separator.

2. tests/unit/test_vcs.py: Added regression tests for SSH URL handling with and without branch refs.

Testing

• All existing VCS tests pass (27 tests)
• Added 5 new parametrized test cases specifically for SSH URL handling

---

Pull Request opened by Augment Code with guidance from the PR author