# Draft PEP: Recording provenance of installed packages
**URL:** https://discuss.python.org/t/draft-pep-recording-provenance-of-installed-packages/24838
**Category:** Packaging
**Created:** [March 14, 2023, 5:11pm UTC](https://discuss.python.org/t/draft-pep-recording-provenance-of-installed-packages/24838 "2023-03-14T17:11:16Z")
**Posts on this page:** 2
**Page:** 2
### Author:  [@pf\_moore](https://discuss.python.org/u/pf_moore)
#### Post date: [March 20, 2023, 2:39pm UTC](https://discuss.python.org/t/draft-pep-recording-provenance-of-installed-packages/24838/21 "2023-03-20T14:39:34Z")
> [@fridex](#):
>
> This case should be covered by PEP-610.
Unless I’m missing it, the PEP 610 “specification” section doesn’t define what specifically should go into the URL, but given that it’s only relevant when installing a from a “direct URL” specifier, it clearly is the URL in that specifier. But for other cases, that doesn’t apply. Technically, `./app` isn’t a direct URL specifier, it’s an implementation specific extension pip supplies.
So I think this PEP does need to explicitly specify.
> [@fridex](#):
>
> There is also section _Example pip commands and their effect on provenance\_url.json and direct\_url.json_.
An example section isn’t normative, though - implementations don’t have to follow them. As a procedural point, I wouldn’t particularly look at example sections when reviewing a PEP for completeness.
> [@fridex](#):
>
> Is SHOULD sufficient here to avoid the mentioned compatibility issues and keeping adoption by other installers optional?
Yes. But it also means that _consumers_ cannot assume the file is present. Hence my comment about SBOM use cases - I don’t know anything about the requirements there, but something that produces a SBOM report from this data has to be prepared to say something like “package XXX is installed but does not include data about where it came from”.
> [@fridex](#):
>
> I tried to keep git history clean, hence force pushing
I understand _why_ you’re doing it, I’m just saying that I don’t look at comments made on the PR, and if anyone wants their comments to be considered (by me, for the PEP review/approval, at least) they need to be made here, not there.
---
### Author:  [@fridex](https://discuss.python.org/u/fridex)
#### Post date: [April 3, 2023, 3:41pm UTC](https://discuss.python.org/t/draft-pep-recording-provenance-of-installed-packages/24838/22 "2023-04-03T15:41:31Z")
For those who follow the discussion - see [PEP 710 - Recording the provenance of installed packages](https://discuss.python.org/t/pep-710-recording-the-provenance-of-installed-packages/25428).
[Previous page](https://discuss.python.org/t/draft-pep-recording-provenance-of-installed-packages/24838.md?page=1)