Ignore lockfile entries where the source is wrong.

utils/pub/version_solver.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /// Attempts to resolve a set of version constraints for a package dependency
 /// graph and select an appropriate set of best specific versions for all
 /// dependent packages. It works iteratively and tries to reach a stable
 /// solution where the constraints of all dependencies are met. If it fails to
 /// reach a solution after a certain number of iterations, it assumes the
 /// dependency graph is unstable and reports and error.
@@ skipping 165 matching lines @@
   /// first, followed by transitive dependers.
   bool tryUnlockDepender(Dependency dependency, [Set<String> seen]) {
     if (seen == null) seen = new Set();
     // Avoid an infinite loop if there are circular dependencies.
     if (seen.contains(dependency.name)) return false;
     seen.add(dependency.name);
 
     for (var dependerName in dependency.dependers) {
       var depender = getDependency(dependerName);
       var locked = lockFile.packages[dependerName];
-      if (locked != null && depender.version == locked.version) {
+      if (locked != null && depender.version == locked.version &&
+          lockedPackage.source.name == dep.source.name) {
         enqueue(new UnlockPackage(depender));
         return true;
       }
     }
 
     return dependency.dependers.map(getDependency).any((subdependency) =>
         tryUnlockDepender(subdependency, seen));
   }
 
   List<PackageId> buildResults() {
@@ skipping 156 matching lines @@
     // anything since it's already at the best version.
     if (name == solver._root.name) {
       solver.enqueue(new ChangeVersion(
           name, source, description, solver._root.version));
       return null;
     }
 
     // If the dependency is on a package in the lockfile, use the lockfile's
     // version for that package if it's valid given the other constraints.
     var lockedPackage = solver.lockFile.packages[name];
-    if (lockedPackage != null) {
+    if (lockedPackage != null && newDependency.source == lockedPackage.source) {
       var lockedVersion = lockedPackage.version;
       if (newConstraint.allows(lockedVersion)) {
         solver.enqueue(
             new ChangeVersion(name, source, description, lockedVersion));
         return null;
       }
     }
 
     // The constraint has changed, so see what the best version of the package
     // that meets the new constraint is.
@@ skipping 331 matching lines @@
 
   String toString() {
     // TODO(nweiz): Dump descriptions to YAML when that's supported.
     return "Incompatible dependencies on '$package':\n"
         "- '$depender1' depends on it with description "
         "${json.stringify(description1)}\n"
         "- '$depender2' depends on it with description "
         "${json.stringify(description2)}";
   }
 }