From f0f036a34c7f5187025171e3c39dd941f30e273c Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 8 Aug 2025 10:08:44 -0700 Subject: [PATCH] fixup pinning (#10400) this is in response to https://github.com/certbot/certbot/pull/10399#issuecomment-3166305086 this PR does two things: 1. it clarifies what is meant by "build dependencies" in DESIGN.md 2. fixes our workaround for https://github.com/python-poetry/poetry/issues/4103 which broke when we moved most of our code under `src` directories. i kept the previous `rm -rf ${REPO_ROOT}/*/*.egg-info` line around for `letstest` and to hopefully add some robustness for us if we ever move our code around again --- tools/pinning/DESIGN.md | 12 ++++++++++-- tools/pinning/common/export-pinned-dependencies.sh | 1 + 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/tools/pinning/DESIGN.md b/tools/pinning/DESIGN.md index 946eb927e..64ab95d2d 100644 --- a/tools/pinning/DESIGN.md +++ b/tools/pinning/DESIGN.md @@ -89,8 +89,16 @@ the same way across all environments. Luckily, this is a largely a theoretical problem and I'm aware of no issues with our current dependencies. The second problem with this approach is that build dependencies are not -tracked and pinned. Unfortunately, [this seems to be a largely unsolved problem -in Python right +tracked and pinned. To be clear, normal runtime dependencies like those +declared in "install_requires" in setup.py files and even optional runtime +dependencies like those declared in "extras_require" in setup.py are managed +properly. The problem here is with dependencies needed at build time when +initially installing a Python project. These are usually specified in +"setup_requires" in setup.py or under "requires" in the "build-system" section +of pyproject.toml files. + +Unfortunately, [tracking and pinning build dependencies seems to be a largely +unsolved problem in Python right now](https://discuss.python.org/t/pinning-build-dependencies/8363). Our tooling ensures that when installing build dependencies when using our pinning files that versions from the pinning files are used (see diff --git a/tools/pinning/common/export-pinned-dependencies.sh b/tools/pinning/common/export-pinned-dependencies.sh index a136472b8..02928d91c 100755 --- a/tools/pinning/common/export-pinned-dependencies.sh +++ b/tools/pinning/common/export-pinned-dependencies.sh @@ -30,6 +30,7 @@ fi # delete them before generating the lock file. See # https://github.com/python-poetry/poetry/issues/4103 for more info. rm -rf ${REPO_ROOT}/*/*.egg-info +rm -rf ${REPO_ROOT}/*/src/*.egg-info cd "${WORK_DIR}"