Paul Moore

> (If there's a better tool than pip for this, I'm happy to hear it, but I'm not aware of another.) If you're building a wheel, rather than installing, [build](https://pypi.org/project/build/)...

> Perhaps there's other options too, but I'd be interested in which direction the maintainers prefer. I can't speak for the other maintainers, but my personal view is somewhere between...

This is basically a standards issue at the core. Hashes are a form of locking, and currently we have no package locking standard. In particular: 1. The [specification for requirements](https://packaging.python.org/en/latest/specifications/dependency-specifiers/)...

> It's only a standards issue in the sense that pip's existing installer features don't currently work in this scenario I guess that's true, yes. Given that pip is tending...

If you'd prefer I can take it. My availability is also limited, but for me it's more unreliable, so it'll be a case of "you'll get the release when I...

The installer information comes from the `INSTALLER` file created when the package was installed. It's the responsibility of the installer to put the correct information in there. It looks like...

As a general principle, `--target` is only really supported when being used to install into an empty target directory. We don't formally state that other uses aren't valid, but if...

I'm pretty sure that actually blocking `--target` on a non-empty directory would break a lot of existing code. It may be flaky, but experience shows that people are likely to...

> https://github.com/pypa/pip/pull/12208 should be an easy merge, I've taken a look at this one, although I had enough questions before I got to the main code change in `lazy_wheel.py` that...

> After a lengthy investigation, I've discovered that the http cache from CacheControlAdapter will still make GET requests against files.pythonhosted.org, even when the file is already in the http cache....