PYTHONPATH ordering breakage when installing packages via plugin

[adamdicarlo0]

What happened?

When installing both awscli2 and aws-sam-cli via a devbox plugin (plugin.json's packages entry), the aws command fails to start in the main project's devbox shell:

(devbox) ❯ aws
Traceback (most recent call last):
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/bin/.aws-wrapped", line 20, in <module>
    import awscli.clidriver
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/clidriver.py", line 21, in <module>
    import botocore.session
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/session.py", line 27, in <module>
    import botocore.client
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/client.py", line 16, in <module>
    from botocore import UNSIGNED, waiter, xform_name
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/waiter.py", line 17, in <module>
    from botocore.docs.docstring import WaiterDocstring
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/docs/__init__.py", line 15, in <module>
    from botocore.docs.service import ServiceDocumenter
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/docs/service.py", line 14, in <module>
    from botocore.docs.client import ClientDocumenter, ClientExceptionsDocumenter
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/docs/client.py", line 16, in <module>
    from botocore.docs.example import ResponseExampleDocumenter
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/docs/example.py", line 13, in <module>
    from botocore.docs.shape import ShapeDocumenter
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/docs/shape.py", line 19, in <module>
    from botocore.utils import is_json_value_header
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/utils.py", line 35, in <module>
    import botocore.httpsession
  File "/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages/awscli/botocore/httpsession.py", line 21, in <module>
    from urllib3.util.ssl_ import (
ImportError: cannot import name 'DEFAULT_CIPHERS' from 'urllib3.util.ssl_' (/nix/store/brmihk12wdrnh5awyqzj42kf6jqdpcip-python3.11-urllib3-2.2.1/lib/python3.11/site-packages/urllib3/util/ssl_.py)

Steps to reproduce

git clone https://github.com/adamdicarlo0/devbox-plugin-issue.git
cd devbox-plugin-issue
devbox run -- aws

Comparing the entries in PYTHONPATH when installing the packages directly via devbox.json (see the non-plugin-example folder), and installing the packages through the plugin, they are the same, but in a different order:

devbox run -- ./compare-pythonpath.sh

Output of compare-pythonpath.sh

❯ devbox run -- ./compare-pythonpath.sh
Welcome to devbox!
Welcome to devbox!
Welcome to devbox!
--- pythonpath.no-plugin.txt	2024-04-29 18:16:22.478577153 -0700
+++ pythonpath.with-plugin.txt	2024-04-29 18:16:22.523575923 -0700
@@ -1,29 +1,13 @@
 /nix/store/7c10im5lz5fcsrznbc6n5qn91af6g17c-python3.11-cffi-1.16.0/lib/python3.11/site-packages
 /nix/store/j0y0cl17f7q1hmciqibg7r35qgggvhs3-python3.11-pycparser-2.21/lib/python3.11/site-packages
 /nix/store/glfr70gi7hfaj50mwj2431p8bg60fhqw-python3-3.11.9/lib/python3.11/site-packages
-/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages
-/nix/store/4l0p95h1s9i58k26j7vv7i550ix1zk1p-python3.11-awscrt-0.20.6/lib/python3.11/site-packages
-/nix/store/7040qyvh67c90k9wbs8vd96h3w3p9gjp-python3.11-bcdoc-0.16.0/lib/python3.11/site-packages
-/nix/store/9spa82ij7waw7p5hrymwl2lfdh8ans42-python3.11-botocore-1.34.58/lib/python3.11/site-packages
-/nix/store/pdzc3ck0gyfapjyg43s4l1wbdczplmvc-python3.11-jmespath-1.0.1/lib/python3.11/site-packages
-/nix/store/rpc4lf3396lvy937l9nmxqmrrwxk0w73-python3.11-python-dateutil-2.8.2/lib/python3.11/site-packages
-/nix/store/h9zc1rhbx7ms31gp8gdyj2rxkklp2avr-python3.11-six-1.16.0/lib/python3.11/site-packages
-/nix/store/0s63ix42n3bwhf6gsq513qmgsbgcn0ah-python3.11-urllib3-1.26.18/lib/python3.11/site-packages
-/nix/store/8n8p6js4gv4ph9pyrz1z6w7mpfk0faps-python3.11-colorama-0.4.6/lib/python3.11/site-packages
-/nix/store/2w26mdk588zz5k1fmgxabh8b98568f7m-python3.11-cryptography-42.0.5/lib/python3.11/site-packages
-/nix/store/hsik92pdzls4s0bii5sygzi31483rx31-python3.11-distro-1.9.0/lib/python3.11/site-packages
-/nix/store/qgx647dzaxkr9iimq5rj52jz3sz14pn4-python3.11-docutils-0.20.1/lib/python3.11/site-packages
-/nix/store/dxnkad89zqgsnkglib65l4d5klcfr8aa-python3.11-prompt-toolkit-3.0.43/lib/python3.11/site-packages
-/nix/store/3vbwpc8djhmjjhjr4lyz95ifvcm16qbb-python3.11-wcwidth-0.2.13/lib/python3.11/site-packages
-/nix/store/cgmgvrybpywqklidqqs4m9nlkckhayzk-python3.11-pyyaml-6.0.1/lib/python3.11/site-packages
-/nix/store/5yyprfhzm8hgd3p8cq19591a3dp9nfdi-python3.11-ruamel-yaml-0.18.6/lib/python3.11/site-packages
-/nix/store/8ipkb52vhwmnam7wj11294lr9zpdgwvf-python3.11-ruamel-base-1.0.0/lib/python3.11/site-packages
-/nix/store/1yw03dy9rk8v7g48jvgahkks4nykz6vp-python3.11-ruamel-yaml-clib-0.2.7/lib/python3.11/site-packages
 /nix/store/55321735bm1vm4fjg086nd8vwfmpbd7k-aws-sam-cli-1.115.0/lib/python3.11/site-packages
 /nix/store/09ds5kbknckp4r80jifjkxqp2dlyl9il-python3.11-aws-lambda-builders-1.48.0/lib/python3.11/site-packages
+/nix/store/h9zc1rhbx7ms31gp8gdyj2rxkklp2avr-python3.11-six-1.16.0/lib/python3.11/site-packages
 /nix/store/35c1s25jf02gcb4da7qvi0drx4r14wm3-python3.11-aws-sam-translator-1.86.0/lib/python3.11/site-packages
 /nix/store/rikm15rkfr9hma4iz1wih3f57878y549-python3.11-boto3-1.34.58/lib/python3.11/site-packages
 /nix/store/mi20rvjxnrg29p8fldkhhjir1ss0dlh3-python3.11-botocore-1.34.58/lib/python3.11/site-packages
+/nix/store/pdzc3ck0gyfapjyg43s4l1wbdczplmvc-python3.11-jmespath-1.0.1/lib/python3.11/site-packages
 /nix/store/9izz6gkzxxg3bf8s4v4m9xwbnn3z08fc-python3.11-python-dateutil-2.9.0.post0/lib/python3.11/site-packages
 /nix/store/brmihk12wdrnh5awyqzj42kf6jqdpcip-python3.11-urllib3-2.2.1/lib/python3.11/site-packages
 /nix/store/baiamjwgp1vnqhq8paijapcrvmf3l7d1-python3.11-s3transfer-0.10.0/lib/python3.11/site-packages
@@ -48,6 +32,7 @@
 /nix/store/mcvr63x0qpcx1jmxpl729waxrdf4x9si-python3.11-jsonpointer-2.4/lib/python3.11/site-packages
 /nix/store/9ljf9a4awnsg0rcywdiwqzwdx57m2hnm-python3.11-junit-xml-1.9/lib/python3.11/site-packages
 /nix/store/4azw2rfr1m31v4hj89np92f7spa8vpmj-python3.11-networkx-3.2.1/lib/python3.11/site-packages
+/nix/store/cgmgvrybpywqklidqqs4m9nlkckhayzk-python3.11-pyyaml-6.0.1/lib/python3.11/site-packages
 /nix/store/0vrssa56zbmfvsc7f4c9ji6yyxx2qgyx-python3.11-regex-2023.12.25/lib/python3.11/site-packages
 /nix/store/6mahfydzsli2kxpayn2w8dbqlwn72rzm-python3.11-sarif-om-1.0.4/lib/python3.11/site-packages
 /nix/store/g6gsiiczavjsqrysdwghrgb2kf7al42r-python3.11-sympy-1.12/lib/python3.11/site-packages
@@ -82,8 +67,11 @@
 /nix/store/7qjj4n4jk2cv4hvxk65bmhcmw5sf2phb-python3.11-blinker-1.7.0/lib/python3.11/site-packages
 /nix/store/nzamsvkf9fsrw6b08yqp12jb6l64bzmq-python3.11-itsdangerous-2.1.2/lib/python3.11/site-packages
 /nix/store/fl0gy9v2kb1f7mkmnds3a416gzcrcz2h-python3.11-werkzeug-3.0.1/lib/python3.11/site-packages
+/nix/store/2w26mdk588zz5k1fmgxabh8b98568f7m-python3.11-cryptography-42.0.5/lib/python3.11/site-packages
 /nix/store/rcw0wym3zhyi5jq808cmvn5xv2ngj0hc-python3.11-pyopenssl-24.0.0/lib/python3.11/site-packages
 /nix/store/fk2b8gvw7bydvvbqpiwvfd2pljqpxbgv-python3.11-ruamel-yaml-0.18.6/lib/python3.11/site-packages
+/nix/store/8ipkb52vhwmnam7wj11294lr9zpdgwvf-python3.11-ruamel-base-1.0.0/lib/python3.11/site-packages
+/nix/store/1yw03dy9rk8v7g48jvgahkks4nykz6vp-python3.11-ruamel-yaml-clib-0.2.7/lib/python3.11/site-packages
 /nix/store/bgaybrqsk4ip8rlp7shnhb78aw7kycm7-python3.11-tomlkit-0.12.4/lib/python3.11/site-packages
 /nix/store/smc2fda3wgm99s394ng90sbbvrf1gxmz-python3.11-watchdog-4.0.0/lib/python3.11/site-packages
 /nix/store/byll0z2nsc6ycglh6jf83zl0n59nmq6p-python3.11-mypy-boto3-apigateway-1.34.56/lib/python3.11/site-packages
@@ -100,3 +88,15 @@
 /nix/store/dishmi3107i4g76xvbpz4wv8wyyfs89p-python3.11-mypy-boto3-stepfunctions-1.34.0/lib/python3.11/site-packages
 /nix/store/8cmmv5y3hqq986b50b3qb4v5npbh6zwb-python3.11-mypy-boto3-sts-1.34.0/lib/python3.11/site-packages
 /nix/store/2489b54bnpk3hs5n2hiychx039wm5xa7-python3.11-mypy-boto3-xray-1.34.0/lib/python3.11/site-packages
+/nix/store/xm88si6rhf8vrnlfxnpabsmlgfxiqa47-awscli2-2.15.38/lib/python3.11/site-packages
+/nix/store/4l0p95h1s9i58k26j7vv7i550ix1zk1p-python3.11-awscrt-0.20.6/lib/python3.11/site-packages
+/nix/store/7040qyvh67c90k9wbs8vd96h3w3p9gjp-python3.11-bcdoc-0.16.0/lib/python3.11/site-packages
+/nix/store/9spa82ij7waw7p5hrymwl2lfdh8ans42-python3.11-botocore-1.34.58/lib/python3.11/site-packages
+/nix/store/rpc4lf3396lvy937l9nmxqmrrwxk0w73-python3.11-python-dateutil-2.8.2/lib/python3.11/site-packages
+/nix/store/0s63ix42n3bwhf6gsq513qmgsbgcn0ah-python3.11-urllib3-1.26.18/lib/python3.11/site-packages
+/nix/store/8n8p6js4gv4ph9pyrz1z6w7mpfk0faps-python3.11-colorama-0.4.6/lib/python3.11/site-packages
+/nix/store/hsik92pdzls4s0bii5sygzi31483rx31-python3.11-distro-1.9.0/lib/python3.11/site-packages
+/nix/store/qgx647dzaxkr9iimq5rj52jz3sz14pn4-python3.11-docutils-0.20.1/lib/python3.11/site-packages
+/nix/store/dxnkad89zqgsnkglib65l4d5klcfr8aa-python3.11-prompt-toolkit-3.0.43/lib/python3.11/site-packages
+/nix/store/3vbwpc8djhmjjhjr4lyz95ifvcm16qbb-python3.11-wcwidth-0.2.13/lib/python3.11/site-packages
+/nix/store/5yyprfhzm8hgd3p8cq19591a3dp9nfdi-python3.11-ruamel-yaml-0.18.6/lib/python3.11/site-packages

Command

shell

devbox.json

See https://github.com/adamdicarlo0/devbox-plugin-issue

Devbox version

0.10.5

Nix version

nix (Nix) 2.18.2

What system does this bug occur on?

Linux (x86-64)

Debug logs

No response