Extract the `Generator` from the `WHEEL` file as metadata

[ofek]

What's the problem this feature will solve?

Allow easy discovery of what built the artifacts and at what version

Describe the solution you'd like

1. Section on the side showing the first (multiple wheels possible) parsed build backend, or the full set
2. Add the backend to wheel JSON API response

Additional context

https://discuss.python.org/t/improving-discoverability-of-build-backends/20140/3

[di]

Thanks for the feature request. Could you add more detail about what the use case is here?

Would something like https://inspector.pypi.io/ suit this use case? e.g. https://inspector.pypi.io/project/hatch/1.6.3/packages/59/ab/44150b2177678139e5d6f5bf922adbd9b3f39c4cdbf7091fef1c63ebd47d/hatch-1.6.3-py3-none-any.whl/hatch-1.6.3.dist-info/WHEEL#line.2

Why does it need to be included in a machine-readable API?

[fungi]

It's possible I'm confused as to the relationship of this request to the build backend classifier discussion, but is it assumed that the wheel generator reflects the PEP-517 build backend used? According to the PEP, wheel generation is the domain of the build frontend, which in at least some cases will be an entirely separate program from the backend (and is the case for a backend I maintain, which relies on the wheel library to create wheels from the sdists that backend builds, so its wheels always have a generator of bdist_wheel (some version) in them which it effectively can't override as that's hard-coded into wheel itself).

[ofek]

Could you add more detail about what the use case is here? [...] Why does it need to be included in a machine-readable API?

• Tracking usage and upgrade patterns
• Ability to tell if a release was built by a version that had a bug or CVE that affects the contents

According to the PEP, wheel generation is the domain of the build frontend

Which PEP? That's 100% not true, pip, build, etc. do not modify the wheel

is it assumed that the wheel generator reflects the PEP-517 build backend used? [...] in at least some cases will be an entirely separate program from the backend

It should imo as that is what every backend but setuptools does (or users of wheel)

[fungi]

Apologies, you're right I misinterpreted the terminology section of PEP 517. Just to be clear, though, I maintain a build backend which creates sdists and then relies on the wheel library to create wheels from those, so the wheel generator metadata won't reflect the name of the the build backend for projects relying on it (and as you point out, the same goes for projects using SetupTools, which isn't exactly a negligible subset).

[ofek]

pypa/wheel#479