New PEP proposal: adding package source (index or find-package) to installers

[msarahan]

During the index priority workshop at Meta, we identified that adding the package source will be essential to troubleshooting issues with environments. We think that this is an issue that can be broken out into a smaller, standalone PEP. @atalman has volunteered to lead this.

Possible things that need change:

• cache key
• dist info

[rgommers]

I first read this as "adding the source code of the package" - but I guess it's "keep track of the URL the installed wheel or sdist for the package was retrieved from"?

[DEKHTIARJonathan]

Do you mean "something like a lockfile" ?

[[package]]
name = "argparse"
version = "1.4.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/18/dd/e617cfc3f6210ae183374cd9f6a26b20514bbb5a792af97949c5aacddf0f/argparse-1.4.0.tar.gz", hash = "sha256:62b089a55be1d8949cd2bc7e0df0bddb9e028faefc8c32038cc84862aefdd6e4", size = 70508 }
wheels = [
    { url = "https://files.pythonhosted.org/packages/f2/94/3af39d34be01a24a6e65433d19e107099374224905f1e0cc6bbe1fd22a2f/argparse-1.4.0-py2.py3-none-any.whl", hash = "sha256:c31647edb69fd3d465a847ea3157d37bed1f95f19760b11a47aa91c04b666314", size = 23000 },
]

[kmaehashi]

You might already be aware, but PEP 610 could be relevant (which only focuses on packages installed outside of indices):

https://peps.pythondiscord.com/pep-0610/
https://packaging.python.org/en/latest/specifications/direct-url/

[DEKHTIARJonathan]

@msarahan ^^^^^^^^

[atalman]

Hi @DEKHTIARJonathan @rgommers @kmaehashi and @msarahan Yes I believe we are looking for something similar to PEP 610: https://peps.pythondiscord.com/pep-0610/ . When dealing with multiple indexes pip install should record which file comes from which index.
I believe this will be needed in order to debug issues with packages. In PyTorch we developed this script: https://raw.githubusercontent.com/pytorch/pytorch/main/torch/utils/collect_env.py that collects user environment. Hence having package - index listing here would help us debug user issues.