VCS requirements don't match the candidates locked in the pdm.lock

[gregdan3]

• I have searched the issue tracker and believe that this is not a duplicate.

Steps to reproduce

• Prepare a package with a dependency on requests[socks], and another with a dependency on requests[security]
• pdm add [package1]
• pdm add [package2]
• Observe that second command fails due to InconsistentCandidate

You can use the following pyproject.toml:

[project]
name = "deps"
version = "1.0.0"
description = "example project"
authors = []
dependencies = []
dev-dependencies = []
requires-python = ">=3.7"
dynamic = []
license = {}

[build-system]
requires = ["pdm-pep517"]
build-backend = "pdm.pep517.api"

And the following commands:

pdm add git+https://github.com/gregdan3/pdm-name-example.git@depextra-a#egg=depextra-a -vv
pdm add git+https://github.com/gregdan3/pdm-name-example.git@depextra-b#egg=depextra-b -vv

To obtain this result upon running the second command:

gregdan3@Theros ~/temp> pdm add git+https://github.com/gregdan3/pdm-name-example.git@depextra-b#egg=depextra-b -vv
Adding packages to default dependencies: depextra-b
======== Start resolving requirements ========
        depextra-a @ git+https://github.com/gregdan3/pdm-name-example.git@depextra-a
        depextra-b @ git+https://github.com/gregdan3/pdm-name-example.git@depextra-b
        Adding requirement depextra-a @ git+https://github.com/gregdan3/pdm-name-example.git@depextra-a
Preparing isolated env for PEP 517 build...
Requirement already satisfied: pdm-pep517 in /usr/lib/python3.9/site-packages (from -r /tmp/pdm-build-reqs-2hn034nm.txt (line 1)) (0.5.7)
 - Adding depextra_a-1.0.0_.dist-info/WHEEL
 - Adding depextra_a-1.0.0_.dist-info/METADATA
 - Adding depextra_a-1.0.0_.dist-info/RECORD
        Adding requirement depextra-b @ git+https://github.com/gregdan3/pdm-name-example.git@depextra-b
Preparing isolated env for PEP 517 build...
Requirement already satisfied: pdm-pep517 in /usr/lib/python3.9/site-packages (from -r /tmp/pdm-build-reqs-5rkryxnb.txt (line 1)) (0.5.7)
 - Adding depextra_b-1.0.0_.dist-info/WHEEL
 - Adding depextra_b-1.0.0_.dist-info/METADATA
 - Adding depextra_b-1.0.0_.dist-info/RECORD
        Adding requirement requests[socks]~=2.25(from depextra-b 1.0.0:)
Resolving: depextra-b 1.0.0:
        New pin: depextra-b 1.0.0:
======== Ending round 0 ========
        Adding requirement requests[security]~=2.25(from depextra-a 1.0.0:)
Traceback (most recent call last):
  File "/home/gregdan3/.local/bin/pdm", line 8, in <module>
    sys.exit(main())
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/core.py", line 76, in __call__
    return self.main(*args, **kwargs)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/core.py", line 131, in main
    raise err.with_traceback(traceback)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/core.py", line 127, in main
    f(options.project, options)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/cli/commands/add.py", line 35, in handle
    actions.do_add(
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/cli/actions.py", line 175, in do_add
    resolved = do_lock(project, strategy, tracked_names, reqs)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/cli/actions.py", line 70, in do_lock
    mapping, dependencies, summaries = resolve(
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/pdm/resolver/core.py", line 152, in resolve
    result = resolver.resolve(requirements, max_rounds)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/resolvelib/resolvers.py", line 453, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/resolvelib/resolvers.py", line 347, in resolve
    failure_causes = self._attempt_to_pin_criterion(name, criterion)
  File "/home/gregdan3/.local/pipx/venvs/pdm/lib/python3.9/site-packages/resolvelib/resolvers.py", line 221, in _attempt_to_pin_criterion
    raise InconsistentCandidate(candidate, criterion)
resolvelib.resolvers.InconsistentCandidate: Provided candidate <Candidate depextra-a 1.0.0:> does not satisfy <VcsRequirement depextra-a @ git+https://github.com/gregdan3/pdm-name-example.git@depextra-a>

Actual behavior

Dependency resolution fails when the two packages, having a common dependency but with a different optional dependency specification, are installed separately.

Expected behavior

Dependency resolution will not fail with common dependencies using different optional dependencies, regardless of how they are installed.

i.e. pdm add [package1] && pdm add [package2] should have the same final result as pdm add [package1] [package2], but the former fails and the latter does not.

Environment Information

PDM version:        1.4.2
Python Interpreter: /usr/bin/python (3.9.2)
Project Root:       /home/gregdan3/temp
{
  "implementation_name": "cpython",
  "implementation_version": "3.9.2",
  "os_name": "posix",
  "platform_machine": "x86_64",
  "platform_release": "5.11.6-arch1-1",
  "platform_system": "Linux",
  "platform_version": "#1 SMP PREEMPT Thu, 11 Mar 2021 13:48:23 +0000",
  "python_full_version": "3.9.2",
  "platform_python_implementaiton": "CPython",
  "python_version": "3.9",
  "sys_platform": "linux"
}

I prepared the following Dockerfile to demonstrate:

FROM python:3.9-slim
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
            git

RUN mkdir /app
WORKDIR /app
RUN python -m pip install -U pdm
COPY ./pyproject.toml ./
RUN pdm info && pdm info --env
RUN pdm add git+https://github.com/gregdan3/pdm-name-example.git@depextra-a\#egg=depextra-a -vv
RUN pdm add git+https://github.com/gregdan3/pdm-name-example.git@depextra-b\#egg=depextra-b -vv
ENTRYPOINT ["pdm", "list"]