Fix locked VCS dependencies always being updated

poetry/installation/executor.py

@@ -606,7 +606,12 @@ class Executor:
 
         git = Git()
         git.clone(package.source_url, src_dir)
-        git.checkout(package.source_resolved_reference, src_dir)
+
+        reference = package.source_resolved_reference
+        if not reference:
+            reference = package.source_reference
+
+        git.checkout(reference, src_dir)
 
         # Now we just need to install from the source directory
         original_url = package.source_url

poetry/installation/installer.py

@@ -309,12 +309,6 @@ class Installer:
 
         pool.add_repository(repo)
 
-        # We whitelist all packages to be sure
-        # that the latest ones are picked up
-        whitelist = []
-        for pkg in locked_repository.packages:
-            whitelist.append(pkg.name)
-
         solver = Solver(
             root,
             pool,
@@ -323,9 +317,12 @@ class Installer:
             NullIO(),
             remove_untracked=self._remove_untracked,
         )
+        # Everything is resolved at this point, so we no longer need
+        # to load deferred dependencies (i.e. VCS, URL and path dependencies)
+        solver.provider.load_deferred(False)
 
         with solver.use_environment(self._env):
-            ops = solver.solve(use_latest=whitelist)
+            ops = solver.solve(use_latest=self._whitelist)
 
         # We need to filter operations so that packages
         # not compatible with the current system,

poetry/installation/pip_installer.py

@@ -251,7 +251,12 @@ class PipInstaller(BaseInstaller):
 
         git = Git()
         git.clone(package.source_url, src_dir)
-        git.checkout(package.source_reference, src_dir)
+
+        reference = package.source_resolved_reference
+        if not reference:
+            reference = package.source_reference
+
+        git.checkout(reference, src_dir)
 
         # Now we just need to install from the source directory
         pkg = Package(package.name, package.version)

tests/installation/test_installer.py

@@ -14,6 +14,7 @@ from cleo.io.outputs.buffered_output import BufferedOutput
 from cleo.io.outputs.output import Verbosity
 from deepdiff import DeepDiff
 
+from poetry.core.packages.package import Package
 from poetry.core.packages.project_package import ProjectPackage
 from poetry.core.toml.file import TOMLFile
 from poetry.factory import Factory
@@ -1924,3 +1925,66 @@ def test_run_with_dependencies_quiet(installer, locker, repo, package, quiet):
         assert installer._io.output._buffer.read() == ""
     else:
         assert installer._io.output._buffer.read() != ""
+
+
+def test_installer_should_use_the_locked_version_of_git_dependencies(
+    installer, locker, package, repo
+):
+    locker.locked(True)
+    locker.mock_lock_data(
+        {
+            "package": [
+                {
+                    "name": "demo",
+                    "version": "0.1.1",
+                    "category": "main",
+                    "optional": False,
+                    "platform": "*",
+                    "python-versions": "*",
+                    "checksum": [],
+                    "dependencies": {"pendulum": ">=1.4.4"},
+                    "source": {
+                        "type": "git",
+                        "url": "https://github.com/demo/demo.git",
+                        "reference": "master",
+                        "resolved_reference": "123456",
+                    },
+                },
+                {
+                    "name": "pendulum",
+                    "version": "1.4.4",
+                    "category": "main",
+                    "optional": False,
+                    "platform": "*",
+                    "python-versions": "*",
+                    "checksum": [],
+                    "dependencies": {},
+                },
+            ],
+            "metadata": {
+                "python-versions": "*",
+                "platform": "*",
+                "content-hash": "123456789",
+                "hashes": {"demo": [], "pendulum": []},
+            },
+        }
+    )
+
+    package.add_dependency(
+        Factory.create_dependency(
+            "demo", {"git": "https://github.com/demo/demo.git", "branch": "master"}
+        )
+    )
+
+    repo.add_package(get_package("pendulum", "1.4.4"))
+
+    installer.run()
+
+    assert installer.executor.installations[-1] == Package(
+        "demo",
+        "0.1.1",
+        source_type="git",
+        source_url="https://github.com/demo/demo.git",
+        source_reference="master",
+        source_resolved_reference="123456",
+    )