Distinguish between libraries and applications

[MartinThoma]

• I have searched the issues of this repo and believe that this is not a duplicate.
• I have searched the documentation and believe that my question is not covered.

Feature Request

When you have a pure application, e.g. a package which is intended not to be imported by other packages, but only to be executed directly (e.g. CLI application, a web service, some GUI program), it would be nice to have reliable installations at the client.

For reliable installations, it is important that the dependencies (including transitive ones) are pinned. They are pinned in the poetry.lock file, but that file is not uploaded / used when a package built with poetry, uploaded to PyPI.org is installed via pip.

My suggestion is:

• Within [tool.poetry], add is-pure-application: true / false or similar (never-included? no-library?)
• When this attribute is present and true, then poetry adds the transitive dependencies to the shipped setup.py file
• Then, when installed via pipx, one can be absolutely certain about what is installed and have way more control about the environment.

I'm uncertain, however, how to deal with the "normal" pip which does not create a virtual environment for such a package. That would be problematic.

[sinoroc]

I get the general idea, but the suggested method does not make sense to me.

From my point of view, what would make more sense would be to instruct poetry build to write the pinned dependencies as Requires-Dist in the distributions.

This is typically the kind of things I would like to see implemented as a plugin, not necessarily part of poetry proper. Because this seems like one nice way to shoot yourself in the foot, if you pin everything in the distributions without knowing what you are doing.

I'm uncertain, however, how to deal with the "normal" pip which does not create a virtual environment for such a package. That would be problematic.

This does not seem feasible. I do not see what role pip would play in that. I'd rather recommend another plugin that would output a zipapp containing pinned dependencies.

[MartinThoma]

this seems like one nice way to shoot yourself in the foot

Yes, for sure 😁 👍

[MartinThoma]

Could you please point me to documentation about how to create plugins for poetry?

[sinoroc]

The plugin system is under development, scheduled for version 1.2:

• WIP - Plugin system (#1237)

[finswimmer]

From my point of view, what would make more sense would be to instruct poetry build to write the pinned dependencies as Requires-Dist in the distributions.

There is a feature request for this: #2778

But I'm with you @sinoroc that this is a good way to shoot yourself in the foot :)

@MartinThoma: I will close your issue as a more or less duplicate of #2778. Feel free to leave a comment if you disagree with it.

[sinoroc]

@MartinThoma A PR has been filed: #3341. Would you mind giving it a try, giving feedback on it, reviewing the code? Whatever helps to get things moving...

[bneijt]

I've written a small script to achieve an installation you mention, called poetry-lock-package. However, if you create a package like that, it will nolonger be able to share an environment with other programs, effectively requiring an isolated application environment (like docker, pyenv, etc.).

I have used this approach for deploying applications on Databricks as well and that works great, but you need to make sure you don't require stuff that Databricks secretly already has installed on the python path (like pyspark) or for which the environment brings in proprietary "enhanced" packages.

The poetry-lock-package script is crude, but effective. You can read more at https://bneijt.nl/pr/poetry-lock-package/

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.