Checksums not updates when downgrading packages

Describe the problem as clearly as you can

I can't quite repro this, but a few folks have run into it on bundler 2.6.2 on our team

We added checksums (via bundle lock --normalize-platforms; bundle lock --add-checksums) and that's been working great.

However, we recently had to downgrade a gem (httpx in our case), and the first bundle install run put in an empty checksum line for httpx . Note: this downgrade was to a version we previously had locally, so it might have been using a cached version vs a re-download.

rerunning bundle lock --normalize-platforms; bundle lock --add-checksums fixed it up, that said

Did you try upgrading rubygems & bundler?

Yes, on latest for both

Post steps to reproduce the problem

source "https://rubygems.org"
gem "httpx", "~> 1.4.0", require: false

amongst many other things

Changed it to

source "https://rubygems.org"
gem "httpx", "1.3.4", require: false

Which command did you run?

bundle install

What were you expecting to happen?

we had this:

httpx (1.4.0) sha256=REDACTED

get a checksum, instead we got:

httpx (1.3.4)

Start by reproducing the reported sequence with Bundler 2.6.2: add checksums, change httpx from the ~> 1.4.0 constraint to 1.3.4, and run bundle install. Compare the resulting checksum entry with the output after bundle lock --normalize-platforms and bundle lock --add-checksums; done means the downgrade retains a populated checksum without the follow-up commands.