rez-pip duplicate package installation

[ptiwariFolks]

Hey guys!

I noticed for certain packages, rez-pip is not able to detect that they already exist and re installs them as a new variant. You should be able to replicate the issue by following what I was doing:

rez-pip --install astroid --python-version 3.7 -p </path/to/some/isolated/dir>

Once the install is done, re-run the command and you will see rez skipping all existing packages except astroid which it installs again. If we open its package.py, we will see the same variants declared multiple times:

Environment

• linux rocky 9.5
• Rez version 3.2.1
• Rez python version 3.11.9

To Reproduce

1. Run rez-pip --install astroid --python-version 3.7 -p </path/to/some/isolated/dir>
2. Run it again after done executing.

Expected behavior
Rez should have skipped all packages as they are already installed.

Actual behavior
Rez is re-installing astroid each time I run the command.

[ptiwariFolks]

I did some digging and it seems like this has to do with a bug where a list comparison is being done to decide if the package variants exists or not. The order of items can differ when doing this comparison which marks the package as non existing:
https://github.com/AcademySoftwareFoundation/rez/blob/main/src/rezplugins/package_repository/filesystem.py#L1339