pip-compile doesn't compute hashes for all index servers, which leads to pip install failure. Specifically, any index server that provides hashes from its json API, will prevent pip-compile for checking if other installation candidates are available from other index servers.

Environment Versions

1. OS Type
2. Python version: $ python -V
3. pip version: $ pip --version
4. pip-tools version: $ pip-compile --version

Steps to replicate

1. host a simple index server
2. add wheels for source packages in pypi, e.g. avro-python3==1.9.2.1
3. list this requirement in requirements.in
4. run pip-compile --generate-hashes -i 'http://<my local index server>.com/' --extra-index-url https://pypi.org/simple
5. run pip install -r requirements.txt

Expected result

The hashes should include the wheel in the local index server.

Actual result

Only hashes from pypi.org are listed in requirements.txt.

Looking at the implementation, it looks like piptools first tries to get hashes from the first index server that implements the json API. The first server that responds with a json blob is taken as the only hash candidates. Files are not manually hashed for any missing files.

In this case, because some files are on pypi, which implements the json API, other index servers are able to provide valid installation candidates to pip, but piptools does not bother to hash them, thus causing a pip installation failure due to the missing hashes.