Allow setting build env constraints

[webknjaz]

So normally folks put direct unrestricted dependencies into their requires under [build-system] in pyproject.toml. This means that building the same dist may become unpredictable over time. One way to solve this is to somehow generate a dependency tree with all transitive deps pinned and stick it there.

But this approach seems weird. Do you think it'd be reasonable to have something like python -m build ... --constraints=build-env-deps.txt pointing to constraints for use in pip install command?

[FFY00]

This is out of scope IMO. This package aims to be simple, as it is crucial for bootstraping Python environments, so I'd like to avoid bringing much complexity into it. It is a hard line to draw, and this use-case does not seem strong enough. We already provide all the CLI, or API, required for making this work, so not having the glue directly available in the project should not be an issue.

You can acheive the same with the following commands.

pip install -r contraints.txt
python -m build -n

[webknjaz]

The idea here is to avoid using constraints as requirements, because they are not that, though.

[gaborbernat]

I feel like this should be discussed at the PEP level, not the tool level. Currently, PEP-518/517 does not handle your request.

[FFY00]

The idea here is to avoid using constraints as requirements, because they are not that, though.

I think I don't really understand this comment. Could you clarify?

[layday]

Are you able to pass constraints in an env var? Does that work with pip?

[uranusjr]

Yes I think setting PIP_INSTALL_CONSTRAINTS should work (whether that’s a proper feature is up to debate).

[webknjaz]

Yes I think setting PIP_INSTALL_CONSTRAINTS should work (whether that’s a proper feature is up to debate).

Woah, I haven't thought about this. I guess having such a workaround would be useful. Although, for pip install scenario (unrelated to build) it'd probably cause multiple transitive deps in the tree to fail the build...

I think I don't really understand this comment. Could you clarify?

I meant that I'd like to pass --constraints to pip like @layday and @uranusjr while having no pins in [build-system.requires].

[webknjaz]

So while reflecting on this, I now have a slightly different feature idea for build.

Would it be possible to have a command for extracting the list of the build deps from toml? The idea is that if there's something like build --export-sdist-build-deps-to=build-requirements.txt, this would facilitate the manual build env provisioning process w/o having to have an additional to build config parsing implementation.

[layday]

The issue with that is that it might be incomplete if the backend defines extra dependencies in get_requires_for_build_sdist and you can’t call the hook without having previously installed the pyproject.toml dependencies. Sent with [ProtonMail](https://protonmail.com) Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

…

On Tuesday, 11 May 2021 01:32, Sviatoslav Sydorenko ***@***.***> wrote: So while reflecting on this, I now have a slightly different feature idea for build. Would it be possible to have a command for extracting the list of the build deps from toml? The idea is that if there's something like build --export-sdist-build-deps-to=build-requirements.txt, this would facilitate the manual build env provisioning process w/o having to have an additional to build config parsing implementation. — You are receiving this because you were mentioned. Reply to this email directly, [view it on GitHub](#292 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AHNRFWHVA2GYOYYVCDXEZD3TNBNIDANCNFSM44LTSMAA).

[webknjaz]

Yes I think setting PIP_INSTALL_CONSTRAINTS should work (whether that’s a proper feature is up to debate).

I've recently verified that setting PIP_CONSTRAINT works: cherrypy/cheroot@5c1ac08#diff-ef2cef9f88b4fe09ca3082140e67f5ad34fb65fb6e228f119d3812261ae51449R51.

[nitzmahone]

So long as the envvar passes all the way through to the actual build environment when the build deps are installed, that's probably good enough for now, but yeah, agreed that this is a common problem that we've been nailed on numerous times, and just manually syncing the requirements is a lot more problematic than constraining known problem cases. It seems like this is already a problem that every backend needs to solve, so long-term, having a common way to do it would be a Good Thing.

[layday]

I don't see a future where build allows you to constrain your build deps the way it's set up currently - that sounds like the job of a locker/env manager, which build is not. If build had a more pluggable architecture and you could write 'drivers' for pip/Poetry/pdm/pip-lock/who knows what, then it could make sense. But I can't imagine who's gonna make that happen or if build is the place where it should happen.