Use of install_requires = file: requirements.txt raises parse error because hashes are used

[phorward]

Hello!

I want to use install_requires = file: requirements.txt in my setup.cfg to avoid maintaining dependencies twice.

According #1951 and #3253 the file: feature for requires is already available since a while, and I'm on setuptools==62, but I'm getting an exception indicating a parse error pkg_resources.extern.packaging.requirements.InvalidRequirement: Parse error at "'--hash=s'": Expected string_end because the requirements.txt uses hashes.

Is there any (alternative) way to achieve this problem currently?

[abravalheri]

Hi @phorward, this kind of syntax is intentionally not supported.

The file: directive in setuptools requires that each line in the file conform with PEP 508. It is not intended to be fully compatible with pip requirements files.

This is mentioned in the docs^{1 2}:

... the file format for specifying dependencies resembles a requirements.txt file, however please keep in mind that all non-comment lines must conform with PEP 508 (pip-specify syntaxes, e.g. -c/-r/-e flags, are not supported).

Currently in the ecosystem it is not possible to translate such hash requirements to package metadata. So, I don't think there are any fully-compatible alternative for this.

I suppose you can create your own setup.py script that reads the file and strips out pip-specific syntaxes, but that is up to the developer to maintain (and the semantics would differ... there is simply no straight-forward way to guarantee hashes are respected for dependencies in Python distribution packages)

Footnotes

1. https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-6 ↩

2. https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html#dynamic-metadata ↩

[abravalheri]

You might have some luck if you use a direct reference URL with hashes as specified in PEP 440 in your requirements.txt file, instead of --hash. However you might not be able to upload your package to PyPI (PyPI does not accept direct references).

[phorward]

Hello @abravalheri, thanks for the clarification. I think I've now found a way to solve it adequately in setup.py.