@@ -8,6 +8,7 @@ Created: 24-Jul-2024
88Post-History:
99 `25-Jul-2024 <https://discuss.python.org/t/59173 >`__
1010 `30-Oct-2024 <https://discuss.python.org/t/69721 >`__
11+ `15-Jan-2025 <https://discuss.python.org/t/77293 >`__
1112Replaces: 665
1213
1314========
@@ -52,7 +53,7 @@ cost/barrier.
5253
5354The closest the community has to a standard are pip's `requirements files `_
5455which all the aforementioned tools either use directly as their file format or
55- export to (i.e. ``requirements.txt ``). Unfortunately the format is not a
56+ export to (i.e. ``requirements.txt ``). Unfortunately, the format is not a
5657standard but is supported by convention. It's also designed very much for pip's
5758needs, limiting its flexibility and ease of use (e.g., it's a bespoke file
5859format). Lastly, it is not secure by default (e.g., file hash support is
@@ -78,7 +79,7 @@ file. It should also lead to faster installs which are much more frequent than
7879creating a lock file.
7980
8081The data in the file should be consumable by tools not written in Python. This
81- allows for e.g., clould hosting providers to write their own tool to perform
82+ allows for e.g., cloud hosting providers to write their own tool to perform
8283installations in their preferred programming language.
8384
8485The file format should promote good security defaults. As the format is not
@@ -105,7 +106,7 @@ A lock file MUST be named :file:`pylock.toml` or match the regular expression
105106lock files exist. The use of the ``.toml `` file extension is to make syntax
106107highlighting in editors easier and to reinforce the fact that the file format is
107108meant to be human-readable. The prefix and suffix of a named file MUST be
108- lowercase when possible for easy detection and removal,
109+ lowercase when possible, for easy detection and removal,
109110e.g.:
110111
111112.. code-block :: Python
@@ -126,10 +127,10 @@ File Format
126127
127128The format of the file is TOML _.
128129
129- Tools SHOULD write their lock files in a consistent way to minmize noise in diff
130- output. Keys in tables -- including the top-level table -- SHOULD be recorded in
131- a consistent order. As well, tools SHOULD sort arrays in consistent order. Usage
132- of inline tables SHOULD also be kept consistent.
130+ Tools SHOULD write their lock files in a consistent way to minimize noise in
131+ diff output. Keys in tables -- including the top-level table -- SHOULD be
132+ recorded in a consistent order. As well, tools SHOULD sort arrays in consistent
133+ order. Usage of inline tables SHOULD also be kept consistent.
133134
134135
135136``metadata-version ``
@@ -165,7 +166,7 @@ of inline tables SHOULD also be kept consistent.
165166- **Required? **: no
166167- **Inspiration **: PDM _, Poetry _, uv _
167168- Specifies the :ref: `packaging:core-metadata-requires-python ` for the minimum
168- Python version compatibile for any environment supported by the lock file
169+ Python version compatible for any environment supported by the lock file
169170 (i.e. the minimum viable Python version for the lock file).
170171
171172
@@ -638,12 +639,12 @@ a suggestion):
638639 satisfied.
639640#. For each package listed in ``[[packages]] ``:
640641
641- #. If ``marker `` is specified, check if it is satisfied; it it isn't,
642+ #. If ``marker `` is specified, check if it is satisfied; if it isn't,
642643 skip to the next package.
643644 #. If ``requires-python `` is specified, check if it is satisfied; an error
644645 MUST be raised if it isn't.
645646 #. Check that no other instance of the package has been slated to be
646- installed; an error about the ambiguity MUST be raied otherwise.
647+ installed; an error about the ambiguity MUST be raised otherwise.
647648 #. Check that the source of the package is specified appropriately (i.e.
648649 there are not conflicting sources in the package entry);
649650 an error MUST be raised if any issues are found.
@@ -912,12 +913,12 @@ Other keys
912913A single hash algorithm for the whole file
913914==========================================
914915
915- Earlier versions of this PEP proposed having a single hash algrorithm be
916+ Earlier versions of this PEP proposed having a single hash algorithm be
916917specified per file instead of any number of algorithms per file. The thinking
917918was that by specifying a single algorithm it would help with auditing the file
918919when a specific hash algorithm was mandated for use.
919920
920- In the end there was some objection to this idea. Typically it centered around
921+ In the end there was some objection to this idea. Typically, it centered around
921922the cost of rehashing large wheel files (e.g., PyTorch). There was also concern
922923about making hashing decisions upfront on the installer's behalf which they may
923924disagree with. In the end it was deemed better to have flexibility and let
@@ -958,7 +959,7 @@ Locking build requirements for sdists
958959=====================================
959960
960961An earlier version of this PEP tried to lock the build requirements for sdists
961- under a ``packages.build-requires `` key. Unfortunately it confused enough people
962+ under a ``packages.build-requires `` key. Unfortunately, it confused enough people
962963about how it was expected to operate and there were enough edge case issues to
963964decide it wasn't worth trying to do in this PEP upfront. Instead, a future PEP
964965could propose a solution.
@@ -1173,8 +1174,8 @@ detail as to differentiate from any other entry for the same package in the file
11731174(inspired by uv _).
11741175
11751176
1176- Including index-hosted attestatons
1177- ==================================
1177+ Including index-hosted attestations
1178+ ===================================
11781179
11791180:ref: `packaging:index-hosted-attestations ` specifies attestation details for
11801181files uploaded to a package index like PyPI. Including some of those details may
@@ -1189,7 +1190,7 @@ JSON payload as a string, or re-specify some or all of the attestation spec.
11891190Expanding the feature set
11901191-------------------------
11911192
1192- This PEP is currenty oriented towards standardizing on something that can
1193+ This PEP is currently oriented towards standardizing on something that can
11931194replace a ``requirements.txt `` file that acts as a lock file (e.g., what
11941195`pip-tools `_ produces). But with an expansion of features, the file format may be
11951196able to replace the internal lock file format used by tools like PDM _ and
@@ -1200,9 +1201,9 @@ for creating a lock file.
12001201Record the requirements for extras of a package
12011202===============================================
12021203
1203- A project with a ``pyprojec .toml `` file may define some extras which add
1204+ A project with a ``pyproject .toml `` file may define some extras which add
12041205dependencies to install. In the simple case this would just be a matter of
1205- marking an antry in ``[[packages]] `` as only applying when a specific extra is
1206+ marking an entry in ``[[packages]] `` as only applying when a specific extra is
12061207requested. Unfortunately the simple case doesn't cover all cases.
12071208
12081209Consider the following example where the latest release of NumPy is 2.2.1 and
@@ -1221,7 +1222,7 @@ own then NumPy 2.2.1 should be recorded in the lock file, but if extra-2 is
12211222specified (either on its own or in conjunction with extra-1), then NumPy 1.26.4
12221223should be recorded.
12231224
1224- There are two possible soluutions to this.
1225+ There are two possible solutions to this.
12251226
12261227
12271228A single version across all extras in a single lock file
@@ -1234,7 +1235,7 @@ you won't be wondering what version of NumPy you will end up with based on what
12341235extras you select.
12351236
12361237But this does mean that if you want the version of NumPy to vary across extras
1237- you will need to create separate lock files for the varyious NumPy versions you
1238+ you will need to create separate lock files for the various NumPy versions you
12381239want. While not technically an issue, it is ergonomically a bit annoying when
12391240this is necessary. But it's not known how frequently varying package versions
12401241which depend on which extra(s) are chosen occur, and when they do occur do people
@@ -1246,11 +1247,11 @@ used for. This works thanks to extras being additive, and thus only contributing
12461247more packages.
12471248
12481249
1249- Support boolean logic for extra selection
1250+ Support Boolean logic for extra selection
12501251-----------------------------------------
12511252
12521253Another solution to this problem is specifying the conditions under
1253- which a package version applies. This would mean supporting boolean logic
1254+ which a package version applies. This would mean supporting Boolean logic
12541255to fully express the conditions under which a package applies.
12551256
12561257But historically extras have not been expressed this way. The use of the
@@ -1267,18 +1268,18 @@ versions apply.
12671268
12681269For this to work we would either need to expand the use of the ``extra `` clause
12691270so it can be used in ``packages.marker `` or have an ``extras `` key which
1270- expresses a boolean expression for under which the package should be used. In
1271+ expresses a Boolean expression for under which the package should be used. In
12711272both situations the spec around ``extra `` would need to be expanded by this PEP
1272- -- or another PEP before this one is accepted -- to lay out how boolean
1273+ -- or another PEP before this one is accepted -- to lay out how Boolean
12731274expressions would work in this case.
12741275
12751276
12761277Record dependency groups
12771278========================
12781279
12791280Dependency groups have the same concerns as extras mentioned above along with
1280- lacking any preexisting clause for use in dependency specifiers. And so
1281- dependency groups have the added issue that to use boolean expressions would
1281+ lacking any pre-existing clause for use in dependency specifiers. And so
1282+ dependency groups have the added issue that to use Boolean expressions would
12821283require defining a new clause type.
12831284
12841285
0 commit comments