Skip to content

Implement installation from PEP 751 aka standardized lockfiles #13334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
1 task done
the-gabe opened this issue Apr 15, 2025 · 3 comments
Open
1 task done

Implement installation from PEP 751 aka standardized lockfiles #13334

the-gabe opened this issue Apr 15, 2025 · 3 comments
Labels
C: lockfile PEP implementation Involves some PEP type: feature request Request for a new feature

Comments

@the-gabe
Copy link

What's the problem this feature will solve?

I am interested in PEP 751 so that developers can leverage the official python pip package manager to install and manage dependencies with strong security assurances.

I'm creating this issue to track the implementation of this matter as I am highly interested in this.

Describe the solution you'd like

pip implementing PEP 751.

Alternative Solutions

.

Additional context

https://peps.python.org/pep-0751/

Code of Conduct
@the-gabe the-gabe added S: needs triage Issues/PRs that need to be triaged type: feature request Request for a new feature labels Apr 15, 2025
@pfmoore
Copy link
Member

pfmoore commented Apr 15, 2025

As pip is a volunteer-based project, contributions are welcome. This is definitely something we want to do, so it's just a matter of someone finding the time to implement it.

@ichard26 ichard26 changed the title Implementation of PEP 751 Implement PEP 751 aka standardized lockfiles Apr 15, 2025
@ichard26 ichard26 added PEP implementation Involves some PEP C: lockfile and removed S: needs triage Issues/PRs that need to be triaged labels Apr 15, 2025
@ndellosa95 ndellosa95 mentioned this issue Apr 16, 2025
Closed
@edgarrmondragon edgarrmondragon mentioned this issue Apr 22, 2025
Open
@DevonFulcher DevonFulcher mentioned this issue Apr 22, 2025
Merged
DevonFulcher added a commit to dbt-labs/dbt-mcp that referenced this issue Apr 22, 2025
@DevonFulcher
Pin all dependencies (#84)
c5db08b 
Our current install process is with pip in `install.sh`. `install.sh`
makes for an easy installation process, but using pip can mean that
users can get different installations of dbt-mcp. The best way to fix
this would be to install the app from the `uv.lock` file, not with pip.
However, this would require that users have uv installed. In the future,
we can use [uv
export](https://github.com/astral-sh/uv/issues/12584?utm_source=chatgpt.com)
and install from pylock.toml with pip, but [that isn't supported
yet](pypa/pip#13334). In the meantime, pinning
all dependencies should help provide for a more consistent install.
@stefnotch stefnotch mentioned this issue Apr 28, 2025
Open
@sbidoul sbidoul mentioned this issue May 1, 2025
Draft
2 tasks
@sbidoul sbidoul changed the title Implement PEP 751 aka standardized lockfiles Implement installation from PEP 751 aka standardized lockfiles May 1, 2025
@sbidoul
Copy link
Member

sbidoul commented May 1, 2025

The lock file parser, as a first step towards this, is in progress in #13369

@stonebig
Copy link
Contributor

stonebig commented May 4, 2025 •
edited
Loading

Will pip implementation of the lockfile standard allow this ?

  • step1: download a full hash256 list of wheels from pypi (and more) into a ./WheelHouse local directory
  • step2: install the same wheels with the same pylock file from the local ./WheelHouse directory

That would require having the possibility to bypass the url defined in the lockfile, if there is one.

@pradyunsg pradyunsg mentioned this issue May 7, 2025
Closed
1 task
@JCGoran JCGoran mentioned this issue May 11, 2025
Open
@Bibo-Joshi Bibo-Joshi mentioned this issue May 23, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C: lockfile PEP implementation Involves some PEP type: feature request Request for a new feature
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@sbidoul @pfmoore @stonebig @ichard26 @the-gabe