PEP 710 - Recording the provenance of installed packages

[fridex (Fridolín Pokorný)]

@sbidoul

In the specification, should we reference PEP 610, or the corresponding page on packaging.python.org ?

@pf_moore

Also, as a final procedural note, please remove references to PEP 610 from this PEP. You should be referencing, and linking to, the PyPA Specifications, which are the canonical specs - in particular Recording the Direct URL Origin of installed distributions and Direct URL Data Structure

Adjusted here.

@sbidoul

Would it make sense to move the paragraph about caching, close to the part that specifies what url is ?

The paragraph that specifies url is a continuation of the provenance_url.json specification. The url specification is followed by specifying what hashes is as a logical part for specifying file content. The paragraph related to caching follows content specification, as its addition. What is the case for moving the caching paragraph closer to the url specification?

@sbidoul

This file MUST NOT be created when installing a distribution package from a requirement specifying a direct URL reference (including a VCS URL).

Only one of the files provenance_url.json and direct_url.json (from PEP 610), may be present in a given .dist-info directory; installers MUST NOT add both.

I realize the first sentence perhaps makes too much assumptions about the UI of the installer. It makes sense for pip and uv, but maybe not for installer ? Would the second sentence be sufficient as far as the specification is concerned ?

The sentence can also be read from a library API point of view. Here is a PR to remove the sentence if its removal is required.

---

Thanks to @frostming we have an initial implementation in PDM. I’ve opened this PR to pip that have already gone through an initial review. Once the community consolidates on the last bits and understandings, it sounds like we could progress with the PEP - please let us know if anything else is needed.

I will be offline next week, also giving this PEP and discussions around it time to finalize.