a "name1" requirement can be fulfilled by a project called "name1-name2" (for sdists)

[qwcode]

Our requirement matching routine in the finder now tries to get away with not determining the project name, and matching the whole filename (parsed from the pypi url) with <requirement>-. The problem is that a name1-name2 archive url can fulfill a name1 requirement.

This shortcoming has come up before in other issues (#804 (comment))

the code: https://github.com/pypa/pip/blob/1.4.1/pip/index.py#L547

see: #1192 (comment), for when this was discovered in the context of a wheel sorting bug, and a discussion on using distlib.util.split_filename to fix this.

there was a discussion on distutils-sig as well about this: https://mail.python.org/pipermail/distutils-sig/2013-September/022785.html

[dstufft]

Closing this, this is a valid concern, however short of changing the way sdist names are formatted to be similar to wheel (escaping - to _ in names and versions) there's not much we can do about this. In any case, fixing it would require at least discussion on distutils-sig if not a PEP.