pypa
Allow version or version range of setuptools to be specified
When a package does not have the necessary build-system configuration item in its pyproject.toml, or the package doesn't have a pyproject.toml, build returns an a requirement of setuptools >= 40.8.0 (https://github.com/pypa/build/blob/main/src/build/_builder.py#L33-L36). This can cause build reproducibility issues where the version of setuptools is allowed to float. This was particularly an issue when setuptools 78.0.1 was released. Some of out builds broke because of that.
It would be nice if it were possible to provide a specific version or version range for setuptools, preferably through an environment variable. The reason why an environment variable is appealing is that the problem was first noticed while using poetry (which we use as our package management system), and since we're using poetry 1.x, I don't think we could get the poetry maintainers to add a feature for usl
Currently, you can set a constraint file, though that's specific to the backend. It also works transitively that way, since any dependency might need to be built, which then triggers another backend build. You use PIP_CONSTRAINT or UV_CONSTRAINT, depending on which backend you are using. (IIRC, UV_BUILD_CONSTRAINT exists and would trigger for any nested builds, while pip just has the one universal one)
This is for poetry. They don't have an environment variable for this, and they don't honor PIP_CONSTRAINT since they don't use pip.
