Use filelock to lock the file cache

pyproject.toml

@@ -51,6 +51,8 @@ cachecontrol = { version = "^0.12.9", extras = ["filecache"] }
 cachy = "^0.3.0"
 cleo = "^1.0.0a5"
 crashtest = "^0.3.0"
+dulwich = "^0.20.46"
+filelock = "^3.8.0"
 html5lib = "^1.0"
 importlib-metadata = { version = "^4.4", python = "<3.10" }
 jsonschema = "^4.10.0"
@@ -70,7 +72,6 @@ tomlkit = ">=0.11.1,<1.0.0,!=0.11.2,!=0.11.3"
 virtualenv = ">=20.4.3,!=20.4.5,!=20.4.6"
 xattr = { version = "^0.9.7", markers = "sys_platform == 'darwin'" }
 urllib3 = "^1.26.0"
-dulwich = "^0.20.46"
 
 [tool.poetry.group.dev.dependencies]
 pytest = "^7.1"
@@ -155,6 +156,7 @@ module = [
   'cachy.*',
   'cleo.*',
   'crashtest.*',
+  'lockfile.*',
   'pexpect.*',
   'pkginfo.*',
   'requests_toolbelt.*',

src/poetry/utils/authenticator.py

@@ -12,12 +12,14 @@
 from typing import TYPE_CHECKING
 from typing import Any
 
+import lockfile
 import requests
 import requests.auth
 import requests.exceptions
 
 from cachecontrol import CacheControl
 from cachecontrol.caches import FileCache
+from filelock import FileLock
 
 from poetry.config.config import Config
 from poetry.exceptions import PoetryException
@@ -33,6 +35,26 @@
 logger = logging.getLogger(__name__)
 
 
+class FileLockLockFile(lockfile.LockBase):  # type: ignore[misc]
+    # The default LockFile from the lockfile package as used by cachecontrol can remain
+    # locked if a process exits ungracefully.  See eg
+    # <https://github.com/python-poetry/poetry/issues/6030#issuecomment-1189383875>.
+    #
+    # FileLock from the filelock package does not have this problem, so we use that to
+    # construct something compatible with cachecontrol.
+    def __init__(
+        self, path: str, threaded: bool = True, timeout: float | None = None
+    ) -> None:
+        super().__init__(path, threaded, timeout)
+        self.file_lock = FileLock(self.lock_file)
+
+    def acquire(self, timeout: float | None = None) -> None:
+        self.file_lock.acquire(timeout=timeout)
+
+    def release(self) -> None:
+        self.file_lock.release()
+
+
 @dataclasses.dataclass(frozen=True)
 class RepositoryCertificateConfig:
     cert: Path | None = dataclasses.field(default=None)
@@ -122,7 +144,8 @@ def __init__(
                     self._config.repository_cache_directory
                     / (cache_id or "_default_cache")
                     / "_http"
-                )
+                ),
+                lock_class=FileLockLockFile,
             )
             if not disable_cache
             else None