-
-
Notifications
You must be signed in to change notification settings - Fork 449
Open
Labels
⭐ enhancementImprovements for existing featuresImprovements for existing features
Description
Is your feature/enhancement proposal related to a problem? Please describe.
My request is to implement recording provenance information (PEP 710 draft) for packages installed from an index into the environment. This record is useful for generating artifacts out of an existing Python environment, such as creating a lock file or Software Bill-of-Materials document from installed packages.
You can join the discussion on the PEP 710 proposal here.
There is already an existing pull request for pip (that will be rebased soon).
Describe the solution you'd like
PEP 710 is an "extension" of PEP 610, which PDM already supports. For packages that are installed not using PEP 610 a similar file (provenance_url.json
) will be recorded into the dist-info
in the environment with information about the download URL, hashes, and index.
cc @fridex
fridex
Metadata
Metadata
Assignees
Labels
⭐ enhancementImprovements for existing featuresImprovements for existing features