I don't think the current workaround is robust enough: we special case URL requirements and don't expect them to be in the constraints file, and then add them to the explicit requirements to install Some issues: 1) We want to enforce the lockfile being fully comprehensive, i.e.

pex --no-transitive

2) This makes it awkward to pin transitive deps