Zoltan Kochan
f99d19da55
Resolution lived inside the CLI, where it could only run beside an interpreter: the pubgrub provider read a registry that downloads wheels and asks `host.py` what they require. A registry server resolving on a client's behalf can do neither, so the rules move to `pnpm-python-resolver` and the fetching stays with whoever can do it. `step` runs one pubgrub pass and either solves the project or names the one distribution or wheel it still needs, which is the shape the CLI's loop already had. `POST /-/pnpr/v0/resolve` reads `"ecosystem": "pypi"` beside npm and Cargo. The body carries the project's requirements and the interpreter they are for; the answer is the `pylock.toml` the client writes. pnpr reads the metadata file an index publishes beside each wheel (PEP 658, either spelling), falls back to the wheel itself only for an index that publishes none, and keeps what it read for every client that follows — so the client stops downloading whole wheels for versions a resolution then rejects. The client verifies the answer rather than trusting it: the lockfile has to record the inputs this install asked about, its wheels are downloaded and checked against the index's digests, and the project is re-solved against the metadata of what actually arrived. Server-side, a read that does not match the digest the index published is refused before it reaches the solver. Reads are bounded and scoped as the Cargo path's are: an allowlisted index origin, per-project route classification, single-flighted cold reads, and caps on the distributions, metadata reads, each response, and the bytes one request holds. Asking a server which ecosystems it resolves is one memo for both ecosystems now, keyed by server and ecosystem. Related to pnpm/pnpm#14599.
301 B
301 B
@pnpm/pnpr, pacquet
| @pnpm/pnpr | pacquet |
|---|---|
| minor | minor |
pnpm install now resolves Python dependencies through the server configured in pnprServer. The client no longer downloads a wheel to find out what it requires. If the server does not serve Python resolution, pnpm resolves Python dependencies locally.