Skip to content

Conversation

sbidoul
Copy link
Member

@sbidoul sbidoul commented May 6, 2025

Here is the proposal for pylock.toml support.

  • immutable keywords-only dataclasses
  • a from_dict class method to validate and create a Pylock instance from a toml dict (obtained from tomllib.load)
  • a Pylock.to_dict method to convert to a spec-compliant toml dict (assuming types were respected when populating the dataclass), preserving the recommended field ordering
  • this uses frozen keyword-only dataclasses, which makes the constructors look weird, but that will be cleaned up without API change when this project drops support for python 3.9
  • is_valid_pylock_path to validate pylock file names
  • a validate method to check that a Pylock instance is spec compliant (one obtained from from_dict is guaranteed to be, but one created manually may not be)
  • toml (de)serialization left out on purpose

Documentation is still TODO.

closes #898

url: str | None # = None
path: str | None # = None
size: int | None # = None
upload_time: datetime | None # = None
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the spec, the upload_time field is not at the same position for archive and sdist / wheel.

Is that intended or something we want to tweak here and/or in the spec?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That was intended as the idea (and expected value) comes from the index API and I don't think archives are supported there.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if people have uses for an upload time for archives then I suspect making it a 1.1 change wouldn't be controversial.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note my remark was only about the ordering of the fields, not about the presence of upload_time in archive.

@sbidoul
Copy link
Member Author

sbidoul commented Jul 6, 2025

I consider this PR ready for review. I plan to add documentation after a first round of review, assuming the overall design is agreeable to packaging maintainers, of course.

@brettcannon
Copy link
Member

FYI I'm hoping to look at this post-EuroPython in hopes that it helps unblock pip so it can add installation support for pylock.toml.

@brettcannon brettcannon self-requested a review July 25, 2025 17:22
Copy link
Member

@brettcannon brettcannon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good overall! Some docstring tweaks-- since that will be documentation --and potential test tweaks. You can feel free to ignore the assignment expression suggestions if you want.

@sbidoul sbidoul force-pushed the pylock branch 8 times, most recently from a59d102 to bc61305 Compare July 27, 2025 12:48
@sbidoul
Copy link
Member Author

sbidoul commented Jul 27, 2025

@brettcannon thanks for the review. I handled the comments and added a documentation page. This is ready for a second round.

@brettcannon brettcannon self-requested a review August 15, 2025 22:16
@brettcannon
Copy link
Member

LGTM! Thanks for all the work on this, @sbidoul !

@pradyunsg @henryiii any opinions on this before we merge it?

@henryiii
Copy link
Contributor

I'm heading out for a week, won't have time to review the code soon, excited by the idea though! :)

Is the docs failure related? Looks like it might be due to a merge after #897?

@notatallshaw
Copy link
Member

Is the docs failure related? Looks like it might be due to a merge after #897?

The error does look related, if I get a moment in the next few days I will try and checkout this branch and understand why this is happening in the docs build.

@notatallshaw
Copy link
Member

Is the docs failure related? Looks like it might be due to a merge after #897?

Fix: #926

sbidoul and others added 14 commits October 9, 2025 14:55
My idea was to have from_dict independent of the class
to cope for future evolution, but if a new version of the
standard can't be implemented as a subclass of Pylock,
return type of from_dict would change, so it would be
a breaking change.

If/when a new version of the spec arrive, it will still be
time to design the API evolution, depending of the actual changes.
Also make _get_*_as function more versatile by accepting a callable for
the target type.
These comments were remnants of dataclass experiments.
This is more consitent than having some
validations done in the constructor and other in from_dict.
This was not meant to be public
@sbidoul
Copy link
Member Author

sbidoul commented Oct 17, 2025

I added a few commits with some minor improvements, notably:

  • handle the str is a Sequence[str] gotcha in validation
  • validate attestation-identities.kind

Let me know if there is something else I can do.

@brettcannon
Copy link
Member

My approval stands, so I think we just need @henryiii or @pradyunsg to also approve and then we can merge this!

Copy link
Contributor

@henryiii henryiii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I actually thought I had approved this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Standard APIs for PEP 751?

5 participants