Add pip install --dry-run or similar, to get resolution result

[vbabiy]

What's the problem this feature will solve?

pip currently does not have any mechanism for users to get the result of pip's dependency resolution. This functionality is useful for users to be able to:

• generate something like a "lockfile"
• checking if installing a package would break the existing environment
• checking for dependency conflicts among a set of packages
• (more?)

All these can be performed today, but require installing packages to some environment and introspecting the environment for information. Since all the relevant information is available to pip install at run time, it would be useful to avoid hitting issues with this.

Describe the solution you'd like

#8032 proposes a pip install --dry-run option.
#7819 proposes a pip resolve command.
#1345 has more proposals. :)

There have likely more proposals in the issue tracker that I can't find.

Alternative Solutions

Let other not-pip tooling in the ecosystem provide this functionality to users. This is sub-optimal given that pip's resolver isn't exposed publicly in any way (pip's internals are not to be used like a library).

The most notable example is pip-tools project, which is the current best answer for any user who is seeking this functionality.

---

Note: This description has been edited by @pradyunsg in April 2020 (see edit history for details), and some really old, outdated comments have been hidden on this issue.

[grothesque]

Please correct me if I'm wrong, but the following seems to be true:

• Installing a Python package involves executing its setup.py.
• Without a --dry-run option, there's no easy and reliable way to know which packages pip's resolver will choose to install.

Hence, it seems to me that running pip install means consenting to running code from a rather arbitrary selection of PyPI packages on one's machine without an easy and reliable way to audit it. That selection depends recursively on the dependency choices and security practices of individual package authors.

[merwok]

It depends if the project and version to be installed only has a source distribution (sdist, contains setup.py) or also wheels (built distribution, contains a metadata text file, is installed by file copies without arbitrary code being run)

[pradyunsg]

Even with --dry-run, it's likely that pip will need to run build backends for the packages (which for setuptools, involves running the setup.py) which do not have wheels.

[uranusjr]

Have we decided on what to call this functionality yet?

[ofek]

resolve seems logical

[cosmicexplorer]

I called it resolve in #7819. It would correspond for example to the resolve command used for the coursier jvm artifact fetcher: https://get-coursier.io/docs/1.1.0-M11-2/cli-resolve.

[pradyunsg]

#11096 (comment) just landed, adding pip install --dry-run.

@sbidoul Do you wanna close this, or wait under #10771 lands?

[sbidoul]

I'd wait for #10771 as machine readable output is important for several use cases mentioned here or in other issues merged with this one.

[pradyunsg]

It took a while, but we got there in the end! :)

[FlorinAndrei]

I don't see a milestone - which version of pip will get this code?

[sbidoul]

I don't see a milestone - which version of pip will get this code?

It's merged in main. It will be in 22.2 when I do the release, in a week or so.