pip-tools icon indicating copy to clipboard operation
pip-tools copied to clipboard

Implement PEP 751 "A file format to list Python dependencies for installation reproducibility" (a.k.a. lock files | `pylock.toml` | `pylock.*.toml`)

Open webknjaz opened this issue 1 year ago • 5 comments

What's the problem this feature will solve?

Proper ecosystem-standard lock files are getting traction yet again and we have to keep up. This will allow us to work with more ecosystem tooling than just pip, uniformly covering more use cases. And personally, I'm just thrilled to see this PEP implemented across the Python Packaging ecosystem.

Describe the solution you'd like

Implementation of whatever's possible, including both lock file types. The feature should be marked as experimental until PEP 751 is marked as accepted. But it should give people opportunity to try it out and perhaps feed the feedback back into the upstream discussion.

Alternative Solutions

Not doing anything..?

Additional context

This is a follow-up for #1526 that @brettcannon opened years ago.

The initial discussion is @ https://discuss.python.org/t/lock-files-again-but-this-time-w-sdists/46593.

The current open discussion is @ https://discuss.python.org/t/pep-751-lock-files-again/59173.

webknjaz avatar Sep 02 '24 13:09 webknjaz

PEP 751 was accepted today!

Zoidmania avatar Mar 31 '25 20:03 Zoidmania

That's wonderful news!

webknjaz avatar Apr 01 '25 01:04 webknjaz

UPD: https://github.com/pypa/pip/pull/13213 just got in! I bet we can make use of it somehow…

webknjaz avatar Apr 16 '25 14:04 webknjaz

Regarding pip-sync support for these lockfiles: do we want to extend pip-sync to support one new format, or simply implement a new program focused solely on that?

I'm inclined for the latter approach, in the interest of keeping things simple (and "do one thing and do it well").

WhyNotHugo avatar Apr 16 '25 15:04 WhyNotHugo

I'm torn here. I think that a command called "sync" would be exactly what make an env look a certain way. I.e. install from a lock file. OTOH, I also understand wanting to start from a clean slate. There's been mentions of possibly having a pip sync upstream. So even thinking about this might be redundant.

webknjaz avatar Apr 16 '25 19:04 webknjaz