Hacker News Reader

How can you generate a universal lock file when some packages will query the running system in arbitrary ways during resolution?

View on HN

Most packages don't do that. You can get really far by assuming that all of a package's wheels have the same set of dependencies (maybe using environment markers), and that its sdist always returns the same list of dependencies (also maybe using environment markers). No, it's not perfect, but it's also what Poetry and PDM do as far as I know.

Yeah that's right -- we make the assumption that all distributions for a given package will yield the same dependencies, similar to Poetry, PDM, and other tools. This is not strictly required by the standards, but it's very rare for it to be violated.

It's rare, but in my experience it can still be very impactful and hindering adoption.

E.g. that practice seems to be quite prevalent in a few high-profile pytorch packages, which caused our team a lot of pain when trying to enable reproducible cross-platform builds 1-2 years ago

Indeed. I gave up on this and just build in Docker.

Reply on news.ycombinator.com