# PEP 633: Dependency specification in pyproject.toml using an exploded TOML table **URL:** \ **Category:** Packaging\ **Created:** [September 2, 2020, 2:23pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123 "2020-09-02T14:23:38Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![EpicWink](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/epicwink/32/17968_2.png) [@EpicWink](https://discuss.python.org/u/EpicWink)\ **Post date:** [September 10, 2020, 1:39am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/41 "2020-09-10T01:39:51Z")
Would anyone like to sponsor this PEP submission? ---
**Author:** ![xafer](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/xafer/32/248_2.png) [@xafer](https://discuss.python.org/u/xafer)\ **Post date:** [September 10, 2020, 8:09am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/42 "2020-09-10T08:09:43Z")
This PEP in its latest form seems to allow the use of `url` or VCS specific keys (`git`, `hg`, etc). I don’t see the reasoning behind the split ? Would this mean that both: ```auto aiohttp = { git = "ssh://git@github.com/aio-libs/aiohttp.git" } ``` and ```auto aiohttp = { url = "git+ssh://git@github.com/aio-libs/aiohttp.git" } ``` are equivalent ? Is it really worth the extra keys ? Also, the git specific format `aiohttp = { git = "git@github.com:aio-libs/aiohttp.git" }` seems to be allowed as it is present in the `VCS Dependency` example section. Is it intentional ? If it is, we might want to explicitly say so and clarify that VCS specific locations are allowed and that all the backends must be able to transform them in a proper URI to be stored in METADATA. ---
**Author:** ![sdispater](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sdispater/32/1527_2.png) [@sdispater](https://discuss.python.org/u/sdispater)\ **Post date:** [September 10, 2020, 12:39pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/43 "2020-09-10T12:39:17Z")
My understanding was that the `url` was only to be used for direct remote links to package distributions and it’s specified in the PEP: > the URL of the artifact to install and satisfy the requirement. Note that `file://` is the prefix used for packages to be retrieved from the local filesystem. So VCS urls are not permitted for the `url` key. > [@xafer](#): > > Also, the git specific format `aiohttp = { git = "git@github.com:aio-libs/aiohttp.git" }` seems to be allowed as it is present in the `VCS Dependency` example section. > Is it intentional ? I think so, yes. It’s a common format for git ssh urls so it makes sense to support them. However, I think there is an error (or typo) in the PEP since it would translate to `aiohttp @ git+ssh://git@github.com/aio-libs/aiohttp.git@master` and not `aiohttp @ git+ssh://git@github.com:aio-libs/aiohttp.git@master` which is invalid for PEP-508, I think. ---
**Author:** ![uranusjr](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/uranusjr/32/103_2.png) [@uranusjr](https://discuss.python.org/u/uranusjr)\ **Post date:** [September 10, 2020, 1:52pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/44 "2020-09-10T13:52:55Z")
> [@sdispater](#): > > I think so, yes. It’s a common format for git ssh urls so it makes sense to support them. However, I think there is an error (or typo) in the PEP since it would translate to `aiohttp @ git+ssh://git@github.com/aio-libs/aiohttp.git@master` and not `aiohttp @ git+ssh://git@github.com:aio-libs/aiohttp.git@master` which is invalid for PEP-508, I think. To clarify, does this mean the valid TOML representation here would be like this? ```toml aiohttp = { git = "ssh://git@github.com/aio-libs/aiohttp.git" } ``` Because this is the only valid URL form, which is mandated by PEP 508. ---
**Author:** ![sdispater](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sdispater/32/1527_2.png) [@sdispater](https://discuss.python.org/u/sdispater)\ **Post date:** [September 10, 2020, 2:01pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/45 "2020-09-10T14:01:31Z")
What this means is that both representations are valid: ```auto aiohttp = { git = "git@github.com:aio-libs/aiohttp.git" } aiohttp = { git = "ssh://git@github.com/aio-libs/aiohttp.git" } ``` but they must both translate to the following PEP-508 representation: ```nohighlight aiohttp @ git+ssh://git@github.com/aio-libs/aiohttp.git ``` ---
**Author:** ![uranusjr](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/uranusjr/32/103_2.png) [@uranusjr](https://discuss.python.org/u/uranusjr)\ **Post date:** [September 10, 2020, 2:03pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/46 "2020-09-10T14:03:49Z")
Thanks for the clarification. ---
**Author:** ![brettcannon](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/brettcannon/32/34895_2.png) [@brettcannon](https://discuss.python.org/u/brettcannon)\ **Post date:** [September 10, 2020, 5:05pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/47 "2020-09-10T17:05:17Z")
If you don’t hear from anyone in the next 24 hours I will sponsor to help keep this moving forward (but I am staying neutral between both proposed PEPs). ---
**Author:** ![EpicWink](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/epicwink/32/17968_2.png) [@EpicWink](https://discuss.python.org/u/EpicWink)\ **Post date:** [September 10, 2020, 11:10pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/48 "2020-09-10T23:10:38Z")
> [@sdispater](#): > > However, I think there is an error (or typo) in the PEP You’re right, there were errors in the examples. A VCS repository path must be a URL as specified in PEP 440. The PEP has been updated to reflect this. ---
**Author:** ![brettcannon](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/brettcannon/32/34895_2.png) [@brettcannon](https://discuss.python.org/u/brettcannon)\ **Post date:** [September 11, 2020, 10:24pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/49 "2020-09-11T22:24:12Z")
Looks like no one came forward so I submitted PR review comments to [https://github.com/python/peps/pull/1595](https://github.com/python/peps/pull/1595) to make myself the sponsor of this PEP. ---
**Author:** ![EpicWink](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/epicwink/32/17968_2.png) [@EpicWink](https://discuss.python.org/u/EpicWink)\ **Post date:** [September 12, 2020, 12:56pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/50 "2020-09-12T12:56:29Z")
Some things that came up in the review: - Both the empty string `""` and the empty table `{}` are currently meant to signify no constraint, which fails the Zen as there’s multiple ways to do things. In addition, the empty array `[]` is disallowed (specifically because an array is really supposed to be used for multiple requirements. Currently even now the spec allows an array of 1 item…) - Should unknown keys cause an error, cause a warning or just be silently ignored? I could see not erroring meaning tools could have specific functionality based on non-standard keys, for better or worse. ---
**Author:** ![abn](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/abn/32/2504_2.png) [@abn](https://discuss.python.org/u/abn)\ **Post date:** [September 12, 2020, 3:18pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/51 "2020-09-12T15:18:22Z")
> [@EpicWink](#): > > @abn can you [sign the Python CLA](https://www.python.org/psf/contrib/contrib-form/) (or add your GitHub to your [bugs.python.org](http://bugs.python.org) account) please? Done. > [@brettcannon](#): > > Correct. That can change with the proper argument. But do note that naming was done based on how other communities name things (which is ironic as that’s an argument this group is making against PEP 508 😉). I can appreciate the irony 🙂, but the motivation, atleast for me, is to make use of the structure that TOML affords us to allow for better downstream tooling. So, it does not necessarily have to be what other communities name things. > [@EpicWink](#): > > Should unknown keys cause an error, cause a warning or just be silently ignored? I could see not erroring meaning tools could have specific functionality based on non-standard keys, for better or worse. I think this should be left to the tools to handle, however, needs to be explicitly noted that if tool A specifies key K, tool B has no obligation to honour it. Alternative, is to enforce this and allow for tool specific configuration to be handled, similar to dataclass’s `metadata` parameter. > [@EpicWink](#): > > Both the empty string `""` and the empty table `{}` are currently meant to signify no constraint, which fails the Zen as there’s multiple ways to do things. In addition, the empty array `[]` is disallowed (specifically because an array is really supposed to be used for multiple requirements. Currently even now the spec allows an array of 1 item…) One could argue that practicality beats purity. That said, the use of `[]` failing introduces ambiguity. I feel it might be good to simply allow `[]` so that strings, inlinetables and arrays are allowed. I know its going in the other direction, but seems more pragmatic. But ofcourse this is a subjective view. ---
**Author:** ![uranusjr](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/uranusjr/32/103_2.png) [@uranusjr](https://discuss.python.org/u/uranusjr)\ **Post date:** [September 12, 2020, 4:35pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/52 "2020-09-12T16:35:44Z")
> [@EpicWink](#): > > Both the empty string `""` and the empty table `{}` are currently meant to signify no constraint, which fails the Zen as there’s multiple ways to do things. The Zen of Python says there should be one _obvious_ way, not there must only be one way. And the obvious way may not even seem obvious unless you’re Dutch. Don’t disallow representations for the sake of it, but only if it makes sense. Lay out things logically, and good design will follow. ---
**Author:** ![brettcannon](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/brettcannon/32/34895_2.png) [@brettcannon](https://discuss.python.org/u/brettcannon)\ **Post date:** [September 14, 2020, 7:24pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/53 "2020-09-14T19:24:04Z")
> [@EpicWink](#): > > Both the empty string `""` and the empty table `{}` are currently meant to signify no constraint, which fails the Zen as there’s multiple ways to do things. In addition, the empty array `[]` is disallowed (specifically because an array is really supposed to be used for multiple requirements. Currently even now the spec allows an array of 1 item…) You could expand it to “any false-y value” and then even `false` in TOML would work 😉. If you are going to allow both string and table values then supporting both can make sense. But right now, the PEP is written where the empty string support is a single line mentioning it and the rest of the whole PEP just uses the `{}` format. I would either justify having both a bit more and think about which one will be the most common, or choose one. > [@abn](#): > > I think this should be left to the tools to handle, however, needs to be explicitly noted that if tool A specifies key K, tool B has no obligation to honour it. Alternative, is to enforce this and allow for tool specific configuration to be handled, similar to dataclass’s `metadata` parameter. But this also leads to potentially more serious future-conflict if we decide to officially add a key; that’s way more serious than two tools conflicting. If you want to allow for tool-specific keys you will probably need to namespace them somehow. Otherwise I would disallow non-standard keys. ---
**Author:** ![brettcannon](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/brettcannon/32/34895_2.png) [@brettcannon](https://discuss.python.org/u/brettcannon)\ **Post date:** [September 16, 2020, 6:46pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/54 "2020-09-16T18:46:16Z")
Are you all ready to discuss [https://www.python.org/dev/peps/pep-0633/](https://www.python.org/dev/peps/pep-0633/) in general with the PEP 508-related solution? ---
**Author:** ![steve.dower](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/steve.dower/32/56_2.png) [@steve.dower](https://discuss.python.org/u/steve.dower)\ **Post date:** [September 17, 2020, 10:30pm UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/55 "2020-09-17T22:30:27Z")
All of the PEP 508 examples in this PEP have unnecessary parentheses. For example: > aiohttp (\>= 3.6.2, \< 4.0.0) > aiohttp = { version = “\>= 3.6.2, \< 4.0.0” } Should really be: > aiohttp \>= 3.6.2, \< 4.0.0 > aiohttp = { version = “\>= 3.6.2, \< 4.0.0” } The other PEP consistently omits the parentheses, and TBH I’ve never seen them used in the wild. (Honestly, it’s not enough to sway me to this proposal over the other, but it jumps out as making the comparisons look a little unfair.) ---
**Author:** ![sdispater](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sdispater/32/1527_2.png) [@sdispater](https://discuss.python.org/u/sdispater)\ **Post date:** [September 18, 2020, 9:46am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/56 "2020-09-18T09:46:08Z")
As far as I know, parentheses are accepted by PEP-508 and, in my opinion, they improve readability by explicitly separating the package name from the version constraint. And it’s the format used by the PyPI JSON API (see [https://pypi.org/pypi/ipython/json](https://pypi.org/pypi/ipython/json)). I know this API is not standardized but it’s still there. It also is the format used and specified by the PEP 345 for the `Requires-Dist` metadata. > it jumps out as making the comparisons look a little unfair How so? ---
**Author:** ![pradyunsg](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/pradyunsg/32/206_2.png) [@pradyunsg](https://discuss.python.org/u/pradyunsg)\ **Post date:** [September 18, 2020, 9:49am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/57 "2020-09-18T09:49:54Z")
> [@sdispater](#): > > How so? Since I don’t think any package author writes their dependency specifications with parenthesis – and that’s what this PEP is for. 🙂 ---
**Author:** ![sdispater](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sdispater/32/1527_2.png) [@sdispater](https://discuss.python.org/u/sdispater)\ **Post date:** [September 18, 2020, 10:04am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/58 "2020-09-18T10:04:59Z")
I don’t understand. This PEP is for a TOML representation of dependencies so package authors, if they use this PEP to do it, won’t have to bother knowing the PEP 508 notation. And honestly, this PEP is for a project’s metadata representation, so the acceptable generated specification format should be the core metadata specification ([https://packaging.python.org/specifications/core-metadata/](https://packaging.python.org/specifications/core-metadata/)) which uses the parentheses notation ([https://packaging.python.org/specifications/core-metadata/#requires-dist-multiple-use](https://packaging.python.org/specifications/core-metadata/#requires-dist-multiple-use)). So, to me, it seems that this PEP gives a generated PEP-508 format that will be accepted everywhere without modification. ---
**Author:** ![uranusjr](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/uranusjr/32/103_2.png) [@uranusjr](https://discuss.python.org/u/uranusjr)\ **Post date:** [September 18, 2020, 10:06am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/59 "2020-09-18T10:06:54Z")
> [@sdispater](#): > > As far as I know, parentheses are accepted by PEP-508 and, in my opinion, they improve readability by explicitly separating the package name from the version constraint. Parentheses are allowed in PEP 508, but [using them in Core Metadata specifically is discouraged](https://packaging.python.org/specifications/core-metadata/#requires-dist-multiple-use): > A version specifier. Tools parsing the format should accept optional parentheses around this, but tools generating it should not use parentheses. ---
**Author:** ![pf\_moore](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/pf_moore/32/35_2.png) [@pf\_moore](https://discuss.python.org/u/pf_moore)\ **Post date:** [September 18, 2020, 10:14am UTC](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123/60 "2020-09-18T10:14:17Z")
> [@sdispater](#): > > This PEP is for a TOML representation of dependencies so package authors, if they use this PEP to do it, won’t have to bother knowing the PEP 508 notation. They will still need to know PEP 508 form for pip command lines, for requirements files, for reading package metadata directly, etc. IMO, it’s unreasonable to assume that users will never need to know PEP 508 syntax (at least for the simpler cases up to maybe the level of `pkg[ex1,ex2] >=1.0, <2.0`). [Previous page](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123.md?page=2) [Next page](https://discuss.python.org/t/pep-633-dependency-specification-in-pyproject-toml-using-an-exploded-toml-table/5123.md?page=4)