cosmicexplorer
commented
2 years ago This seems extremely relevant to the ongoing work in pip to produce a resolve command in pypa/pip#10748. It appears #1132 has already done a lot of work to visualize the output, but I'd like to know your thoughts about how pypa/pip#10748 fits into this goal, and pypa/pip#53 more generally.
I've tried to summarize the more general case of how I understand pex to interact with pip in https://github.com/pypa/pip/issues/10752#issuecomment-1002383524, where it's discussed how pip could be architected in a more "library-like" fashion. I mentioned of course how pex already provides a library API over pip, but I'm wondering if I've correctly characterized the ideal relationship between pex and pip.
More directly focused on this issue, I believe that pypa/pip#10748 can provide exactly the constraint information required for this ticket. Is it correct that #1132 essentially just provides a visualization over the output of a pip resolution? Does this mean that the json output from pypa/pip#10748 enhances and doesn't overlap with that work? Or is there logic to interpret the resolve output that I should look at incorporating into pypa/pip#10748 somehow?
For reference, this is what the current output of pip resolve -o wow.json tensorboard looks like:
{
"implicit_requirements": [
"Requires-Python==3.10.1"
],
"resolution": {
"tensorboard": {
"req": "tensorboard==2.7.0",
"url": "https://files.pythonhosted.org/packages/2d/eb/80f75ab480cfbd032442f06ec7c15ef88376c5ef7fd6f6bf2e0e03b47e31/tensorboard-2.7.0-py3-none-any.whl#sha256=239f78a4a8dff200ce585a030c787773a8c1184d5c159252f5f85bac4e3c3b38",
"hash": {
"name": "sha256",
"value": "239f78a4a8dff200ce585a030c787773a8c1184d5c159252f5f85bac4e3c3b38"
},
"dependencies": {
"werkzeug": "werkzeug>=0.11.15",
"tensorboard-plugin-wit": "tensorboard-plugin-wit>=1.6.0",
"tensorboard-data-server": "tensorboard-data-server<0.7.0,>=0.6.0",
"wheel": "wheel>=0.26",
"absl-py": "absl-py>=0.4",
"protobuf": "protobuf>=3.6.0",
"grpcio": "grpcio>=1.24.3",
"requests": "requests<3,>=2.21.0",
"setuptools": "setuptools>=41.0.0",
"google-auth": "google-auth<3,>=1.6.3",
"numpy": "numpy>=1.12.0",
"markdown": "markdown>=2.6.8",
"google-auth-oauthlib": "google-auth-oauthlib<0.5,>=0.4.1",
"Requires-Python": "Requires-Python==3.10.1"
},
"dist_info_metadata": null
},
"absl-py": {
"req": "absl-py==1.0.0",
"url": "https://files.pythonhosted.org/packages/2c/03/e3e19d3faf430ede32e41221b294e37952e06acc96781c417ac25d4a0324/absl_py-1.0.0-py3-none-any.whl#sha256=84e6dcdc69c947d0c13e5457d056bd43cade4c2393dce00d684aedea77ddc2a3",
"hash": {
"name": "sha256",
"value": "84e6dcdc69c947d0c13e5457d056bd43cade4c2393dce00d684aedea77ddc2a3"
},
"dependencies": {
"six": "six",
"Requires-Python": "Requires-Python==3.10.1"
},
"dist_info_metadata": null
},
... (truncated)The dist_info_metadata key is for PEP 658 support, which is currently not live on PyPI.
Please let me know if there is other relevant information I should be adding to that output that pex would like to have for this ticket or other reasons.
There appears to be no applicable standard here in wide use. A sibling tool has this: https://get-coursier.io/docs/json-report. It seems the Pants project wants this sort of format to render its own dependency information from. Its unclear what information it wants though - hoping folks with an interest can chime in. This could range from a simple adjacency list which could only be used to render the result of a resolve, not the whys. To get to the whys, we'd need to include constraint information for the edges. Its not clear if this should just be opaque text or more structured data.