How to lock 'requires' in '[build-system]'?

[huxuan]

It seems that the 'requires' in '[build-system]' is not included in the lock files, such as pdm-backend, setuptools, any recommended approach to lock them in some way?

[frostming]

There is no such "auto collect" way. But if you specify them manually in pyproject.toml, you can lock them and use --no-isolation to use them

[huxuan]

Hi @frostming, thanks for the prompt answer. I still have several questions as follow up:

There is no such "auto collect" way.

May I know the reason why those build requirements can not be auto collected?

if you specify them manually in pyproject.toml, you can lock them and use --no-isolation to use them

Just for double confirm, you mean to sepcify those requirements as kind of dependencies (maybe a "build" group of dev-dependencies) rather than [build-system.requires], right?

[frostming]

May I know the reason why those build requirements can not be auto collected?

Because pdm's lock is designed for cross-platform. From the view of a locker, it doesn't know whether you can install from pre-built wheels directly or from sdist if the former is not eligible(in short, lock doesn't know how to install). So in the best effort, if we are to add the ability to collect the build requirements, we have to always download the sdist during the lock and parse the pyproject.toml inside the tarball to get them.

Moreover, in PEP 517 specification, users are allowed to inject dynamic dependencies via get_requires_for_(editble/sdist/wheel) hook, that makes it almost impossible to lock the dependencies.

I think you can gain a better understanding of this philosophy by reading https://frostming.com/en/2024/pdm-lockfile/

[huxuan]

Thanks for the explanation! It is definitely a deep understanding of cross-platform lock strategy. Thanks!