Skip to content

Conversation

@sbidoul
Copy link
Member

@sbidoul sbidoul commented May 6, 2025

Here is the proposal for pylock.toml support.

  • immutable keywords-only dataclasses
  • a Pylock.from_dict class method to validate and create a Pylock instance from a toml dict (obtained from tomllib.load)
  • a Pylock.to_dict method to convert to a spec-compliant toml dict (assuming types were respected when populating the dataclass), preserving the recommended field ordering
  • this uses frozen keyword-only dataclasses, which makes the constructors look weird, but that will be cleaned up without API change when this project drops support for python 3.9
  • is_valid_pylock_path to validate pylock file names
  • a validate method to check that a Pylock instance is spec compliant (one obtained from from_dict is guaranteed to be, but one created manually may not be)
  • toml (de)serialization left out on purpose

Documentation is still TODO.

closes #898

url: str | None # = None
path: str | None # = None
size: int | None # = None
upload_time: datetime | None # = None
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the spec, the upload_time field is not at the same position for archive and sdist / wheel.

Is that intended or something we want to tweak here and/or in the spec?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That was intended as the idea (and expected value) comes from the index API and I don't think archives are supported there.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if people have uses for an upload time for archives then I suspect making it a 1.1 change wouldn't be controversial.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note my remark was only about the ordering of the fields, not about the presence of upload_time in archive.

@sbidoul
Copy link
Member Author

sbidoul commented Jul 6, 2025

I consider this PR ready for review. I plan to add documentation after a first round of review, assuming the overall design is agreeable to packaging maintainers, of course.

@brettcannon
Copy link
Member

FYI I'm hoping to look at this post-EuroPython in hopes that it helps unblock pip so it can add installation support for pylock.toml.

@brettcannon brettcannon self-requested a review July 25, 2025 17:22
Copy link
Member

@brettcannon brettcannon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good overall! Some docstring tweaks-- since that will be documentation --and potential test tweaks. You can feel free to ignore the assignment expression suggestions if you want.

@sbidoul sbidoul force-pushed the pylock branch 8 times, most recently from a59d102 to bc61305 Compare July 27, 2025 12:48
@sbidoul
Copy link
Member Author

sbidoul commented Jul 27, 2025

@brettcannon thanks for the review. I handled the comments and added a documentation page. This is ready for a second round.

@brettcannon brettcannon self-requested a review August 15, 2025 22:16
@brettcannon
Copy link
Member

LGTM! Thanks for all the work on this, @sbidoul !

@pradyunsg @henryiii any opinions on this before we merge it?

@henryiii
Copy link
Contributor

I'm heading out for a week, won't have time to review the code soon, excited by the idea though! :)

Is the docs failure related? Looks like it might be due to a merge after #897?

@notatallshaw
Copy link
Member

Is the docs failure related? Looks like it might be due to a merge after #897?

The error does look related, if I get a moment in the next few days I will try and checkout this branch and understand why this is happening in the docs build.

@notatallshaw
Copy link
Member

Is the docs failure related? Looks like it might be due to a merge after #897?

Fix: #926

This was not meant to be public
@sbidoul
Copy link
Member Author

sbidoul commented Oct 17, 2025

I added a few commits with some minor improvements, notably:

  • handle the str is a Sequence[str] gotcha in validation
  • validate attestation-identities.kind

Let me know if there is something else I can do.

@brettcannon
Copy link
Member

My approval stands, so I think we just need @henryiii or @pradyunsg to also approve and then we can merge this!

Copy link
Contributor

@henryiii henryiii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I actually thought I had approved this.

@brettcannon brettcannon merged commit 1b66ec2 into pypa:main Oct 21, 2025
39 checks passed
@brettcannon
Copy link
Member

Thanks to @sbidoul for the PR and everyone for their reviews!

@sbidoul sbidoul deleted the pylock branch October 21, 2025 19:25
@woodruffw
Copy link
Member

This is awesome, thanks a ton @sbidoul!

@brettcannon
Copy link
Member

I now selfishly hope this unblocks pylock.toml installation by pip. 😁

@ichard26
Copy link
Member

ichard26 commented Nov 6, 2025

This is exciting news 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Standard APIs for PEP 751?

7 participants