PEP 710 - Recording the provenance of installed packages

[fridex (Fridolín Pokorný)]

@sbidoul

Before doing an in-depth review of the PEP I would still prefer to see a text that references the Direct URL data structure specification , as mentioned in the previous thread and above.

Place for a direct_url.json parser

By doing this, producers and consumers can confidently use the same code base for direct_url.json and provenance_url.json (especially since there are ideas of having the Direct URL handling code in a library such as packaging or importlib.metadata). This would also simplify the PEP text significantly, I think.

Would it make sense to come up with a prototype for a programmable interface for PEP-610 and PEP-710 as discussed here? While I understand it might be a good idea to reuse PEP-610 parts, I’m not sure how dependent we should be on that PEP. Also, if you have any pointers how the text would be simplified, I would be thankful - I tried to keep the text as minimal as possible, but still keep the necessary context so that the PEP can be read as a standalone document with related links.

@sbidoul

Regarding an index_url field, I also think it is a very useful idea. The implementation in pip might be more difficult though, to be investigated. It would also need to specify what to do when the source artifact is not obtained from an index nor from a direct URL (e.g. from pip’s --find-links option).

Okay, we can add it to the PEP if there are no objections. I also think it could be valuable.

@sethmlarson

If we go the route of using an embedded direct_url format, since provenance_url.json only covers resolved package installs would it make sense to put additional restrictions on the direct_url.url value like “must be http[s]://” or “must not be a VCS URL”? I’m not sure what’s possible to serve as a package index or mirror according to the standards.

If there are no cases that would be block this, we can add such restrictions. Please do raise any concerns if you can think of any exception (I’m not aware of any).

@pradyunsg

@sethmlarson

Maybe a separate proposal for capturing that build environment info would be best?

Yea, I agree. I had a passing thought based on looking at this, and admittedly it’s a thing that we can/should do independently.

If there are no objections, we can keep it out of this PEP.