Python virtual environment install is not deterministic

[larry801]

What about using a package manager with a lock mechanism or a modern Python package manager with PEP 582 support, like Pdm pyflow Poetry.

[feerrenrut]

Could you elaborate on what you mean by not deterministic, so we all have a shared understanding? Perhaps an example of the different states it may end up in?

[larry801]

In pipenv Pipfile.lock ensure sha256 hash for all packages installed

[feerrenrut]

Can you explain a situation where this is important? Where / when has this caused a problem for NVDA? If it hasn't already happened, what would trigger the problem?

[larry801]

Developer experience perspective
pip package resolution is not deterministic so reproduce builds is not guaranteed.
A developer can install different package if you try twice, ci server result can also be different even running twice on the same code.
sphinx_rtd_theme depend on sphinx-doc
verison of dependency of dependency is not locked

We can cache the whole pep518 virtual environment to speed up building or even distribute it as appveyor aritifact
We can specify dependencies and dev-dependencies in pyproject.toml

https://github.com/nvaccess/nvda/network/dependencies
https://dustingram.com/articles/2018/03/05/why-pypi-doesnt-know-dependencies/
https://grassfedcode.medium.com/pep-517-and-518-in-plain-english-47208ca8b7a6

[feerrenrut]

I'm happy to accept a PR to fix the version used for sphinx_rtd_theme.

It seems like if we move to pyproject.toml we would then adopt poetry over pip?