PackageDependenciesTool

Problem

Now that Zope 3 is split into small interdependent packages, it's sometimes hard to see why one package (directly or indirectly) depends on another.

Proposal

Create a tool that can inspect any package for its complete dependency tree and creates a graph for it. This graph could be in plain text or be visualized using tools like graphviz.

This is one of the topics for the FoliageSprint.

Implementation Notes

The right way to extract package metadata is to use the pkg_resources module [1].

... --mgedmin, Mon, 24 Sep 2007 17:16:08 +0000 reply

pkg_resources only works with local files, so we'd need to download everything from pypi in order to get the full dependency tree. That's not optimal.

Is there a way to extract dependency information from PyPI??

... --mgedmin, Mon, 24 Sep 2007 17:23:17 +0000 reply

PyPI? API is documented at http://wiki.python.org/moin/CheeseShopXmlRpc and http://peak.telecommunity.com/DevCenter/EasyInstall#package-index-api. It appears that PyPI? doesn't have dependency information, so we'll have to download all the eggs.

... --mgedmin, Mon, 24 Sep 2007 17:41:56 +0000 reply

For installed packages, you can do

pkg_resources.get_distribution('pkgname').requires()

to get back a list of requirements.

... --mgedmin, Mon, 24 Sep 2007 18:01:10 +0000 reply

High-level overview of eggs: http://peak.telecommunity.com/DevCenter/PythonEggs

... --mgedmin, Mon, 24 Sep 2007 18:12:27 +0000 reply

Thought: there are alternative ways to install stuff (easy_install is one, zc.buildout is another). If different tools pick different versions of a package, they may see different dependencies.

Do we want a tool that follows the logic of zc.buildout, or the one that follows the logic of easy_install?

... --philikon, Mon, 24 Sep 2007 18:37:16 +0000 reply

Thomas Lotze created a tool for graphing out package dependencies: http://pypi.python.org/pypi/tl.eggdeps (visualization done by graphviz). Regarding the deployment choice, I think zc.buildout gives you more flexibility to influence which versions are chosen (newest, prefer-final or even pinned down versions). I would focus on working with zc.buildout, not only because most Zope packages (if not all the ones in svn.zope.org) use it, but also because it makes things easy (egg-cache comes to mind) and repeatable.

... --mgedmin, Mon, 24 Sep 2007 19:59:00 +0000 reply

Using tl.eggdeps with a buildout-based project:

add 'eggdeps' to the 'parts' setting in [buildout].

Add an [eggdeps] section:

[eggdeps]
recipe = zc.recipe.egg
eggs = tl.eggdeps
       your-eggs-here

Run bin/buildout as usual and you'll get a new script bin/eggdeps. Run it to get the dependency graph of the eggs you listed in the [eggdeps] section.