# A proposal for sdist build complexity signaling, providing user agency **URL:** \ **Category:** Packaging\ **Created:** [July 6, 2024, 1:41pm UTC](https://discuss.python.org/t/a-proposal-for-sdist-build-complexity-signaling-providing-user-agency/57474 "2024-07-06T13:41:03Z")\ **Posts on this page:** 1\ **Showing post:** 33
**Author:** ![mikeshardmind](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/mikeshardmind/32/14381_2.png) [@mikeshardmind](https://discuss.python.org/u/mikeshardmind)\ **Post date:** [July 8, 2024, 9:34pm UTC](https://discuss.python.org/t/a-proposal-for-sdist-build-complexity-signaling-providing-user-agency/57474/33 "2024-07-08T21:34:13Z")
> [@pf\_moore](#): > > > [@mikeshardmind](#): > > > > The requirements are for the build backend to decide what to do with. > > Not true, actually - PEP 621 states > > > When specifying project metadata, tools MUST adhere and honour the metadata as specified in this PEP. If metadata is improperly specified then tools MUST raise an error to notify the user about their mistake. While Non-compliant backends can do a lot, compliant ones can still add additional dependencies (Both buildtime and runtime), I don’t think pip or uv have a means of detecting a non-compliant backend outright replaced one package with a drop-in replacement that used native code, and even within compliant backends, that doesn’t mean that there aren’t other dependencies than what’s listed there that the backend could use, which would still lead to a differing list of actual dependencies, just in that case, that differing list is an extension of the original and dynamic, not discoverable without the backend. > [@pf\_moore](#): > > I’m not sure what the link to nvidia-stub is supposed to demonstrate, as the pachage doesn’t provide a sdist, and there’s no link to the project source where I can look to see how the wheel is built… nvidia-stub is a clever hack. It’s a backend, and you can unzip the wheel if you want to look at the specifics of it, I actually thought more people would be aware of what it is and does. It results in modifying metadata during build, and downloading from [https://pypi.nvidia.com](https://pypi.nvidia.com) during install details about it have come up in packaging discussions before: [Selecting variant wheels according to a semi-static specification - #16 by msarahan](https://discuss.python.org/t/selecting-variant-wheels-according-to-a-semi-static-specification/53446/16) --- _[View the full topic](https://discuss.python.org/t/a-proposal-for-sdist-build-complexity-signaling-providing-user-agency/57474)._