Enforce requirement format in build-system.requires

news/6410.bugfix

@@ -0,0 +1,2 @@
+Enforce PEP 508 requirement format in ``pyproject.toml``
+``build-system.requires``.

src/pip/_internal/pyproject.py

@@ -5,6 +5,7 @@ import os
 import sys
 
 from pip._vendor import pytoml, six
+from pip._vendor.packaging.requirements import InvalidRequirement, Requirement
 
 from pip._internal.exceptions import InstallationError
 from pip._internal.utils.typing import MYPY_CHECK_RUNNING
@@ -150,6 +151,21 @@ def load_pyproject_toml(
             reason="'build-system.requires' is not a list of strings.",
         ))
 
+    # Each requirement must be valid as per PEP 508
+    for requirement in requires:
+        try:
+            Requirement(requirement)
+        except InvalidRequirement:
+            raise InstallationError(
+                error_template.format(
+                    package=req_name,
+                    reason=(
+                        "'build-system.requires' contains an invalid "
+                        "requirement: {!r}".format(requirement)
+                    ),
+                )
+            )
+
     backend = build_system.get("build-backend")
     check = []  # type: List[str]
     if backend is None:

tests/unit/test_pep517.py

@@ -1,3 +1,5 @@
+from textwrap import dedent
+
 import pytest
 
 from pip._internal.exceptions import InstallationError
@@ -39,3 +41,23 @@ def test_disabling_pep517_invalid(shared_data, source, msg):
     err_msg = e.value.args[0]
     assert "Disabling PEP 517 processing is invalid" in err_msg
     assert msg in err_msg
+
+
+@pytest.mark.parametrize(
+    ("spec",), [("./foo",), ("git+https://example.com/pkg@dev#egg=myproj",)]
+)
+def test_pep517_parsing_checks_requirements(tmpdir, spec):
+    tmpdir.joinpath("pyproject.toml").write_text(dedent(
+        """
+        [build-system]
+        requires = [{!r}]
+        build-backend = "foo"
+        """.format(spec)
+    ))
+    req = InstallRequirement(None, None, source_dir=tmpdir)
+
+    with pytest.raises(InstallationError) as e:
+        req.load_pyproject_toml()
+
+    err_msg = e.value.args[0]
+    assert "contains an invalid requirement" in err_msg