PEP 751: lock files (again)

[brettcannon]

@pf_moore

The PEP (as far as I know) doesn’t currently say anything about installing a lockfile into a non-empty target environment. I think it deserves a mention

Seems reasonable.

@pf_moore

If they allow it they MUST replace any installed copies of the packages in the lockfiles with the ones specified in the lockfile. This is so that the user can be certain that local changes made to the environment (e.g., manual edits of installed files) are no longer present.

But you are saying all other packages that were installed but not mentioned in the lock file stay, correct?

@pf_moore

In the latter case, of a conflict error, do we require that the installer must leave the environment unchanged, or is it OK to check after doing the install and leave the environment in a broken state? This is probably best left as a tool UX choice.

This would probably be a “SHOULD” scenario.

@notatallshaw

While tools don’t support this feature very well there is a strong desire by some users to lock build backends

Yeah, but this PEP doesn’t have to solve everything upfront either; it’s versioned for a reason.

@notatallshaw

My point was if it is allowed by the spec, as Brett suggested updating it to:

“sdists are acceptable,” and leave it at that.

To be clear, that was meant to suggest sdist support in the lock file would be, “you can install the sdist for a package” and not bother about worrying about locking the build back-end used.

@pf_moore

@notatallshaw

In this situation, the build requirements of the build backend would be installed in some isolated environment on the users machine but not specified by the lock file, right?

Ah, I see what you mean. It’s a good point, and one I think @brettcannon will have to respond to.

I think my response is I’m going to drop [[packages.build-requires]]. It’s been nothing but a headache and point of confusion from the start. And since no other tool that does locking currently supports locking build back-end requirements for an sdist I don’t feel like I need to be the one trying to introduce some innovative solution. Lockers can experiment thanks to the various tool sections and then eventually propose an update to the file format which adds such support.