Bjorn Neergaard

I've opened https://github.com/opencontainers/distribution-spec/issues/483 to discuss/vote on paths forward; I'd like to keep this issue for discussion/clarification of the problem itself, and #483 for discussion of solutions/consensus on what the path...

> storing signatures/attestations/sboms/etc in a repository separate from the image. I must point out once again that changing a `MUST` to a `MAY` doesn't forbid anything. The distribution-spec doesn't disallow...

Currently `poetry self add` is designed solely for convenience/the end user. For development, I would suggest using the copy of `pip` bundled in Poetry's environment. e.g. ```sh ~/.local/share/pypoetry/venv/bin/pip install ```...

You should be using `poetry self show` to introspect Poetry's internal environment

Ah, show is based on the lock file and not solely iterating over the environment -- it will indeed not be great for this use case. Good old `pip list`...

> Also worth noting is using the workaround approach, the custom commands show up in `poetry list`, however using Poetry's internal environment, it does not. Not sure what this means...

Because the lock file is based on the contents of the internal pyproject.toml and not anything installed into the environment using external tooling -- which the internal pip is. The...

Using `pip` is good enough for development even if not ergonomic, and then `poetry self` can be used by end users. Improving `poetry self` for development would be nice, but...

Poetry's `pip` should work -- are you sure you defined the entrypoint on your plugin? Poetry discovers plugins by iterating over entrypoints and importing `tool.poetry.plugins` entrypoints.

It is supposed to be on the plugin `pyproject.toml` only -- I am unable to reproduce your issue with plugins not being detected by Poetry. e.g. ```sh $ ~/.local/share/pypoetry/venv/bin/pip install...