Document the proper metadata for Python libraries

[NathanDeMaria]

• I have searched the issues of this repo and believe that this is not a duplicate.

Issue

In the first FAQ, it's mentioned that, "not all libraries on PyPI have properly declared their metadata". Are there specific pieces of metadata that would help poetry avoid needing to download and inspect packages?

As a reader of that doc who occasionally puts packages on PyPI, it would be helpful for me to know specifically what I can do to make sure libraries I contribute to have the metadata poetry uses properly set

[abn]

@NathanDeMaria the short answer is https://github.com/python-poetry/poetry/blob/master/poetry/inspection/info.py#L64-L70

Or you could make sure you use poetry to build and upload the package :)

[NathanDeMaria]

Is there a way to get more specific than that? I'm looking for some way to know if poetry is needing to download/inspect specific packages/why. Specifically, my questions when reading that are:

• Do I need to set all of those fields? Or just the applicable subset? In particular, what happens if I don't set python versions? Poetry assumes all are fine? Or does that trigger a download?
• Are there ways I can set those values incorrectly? How can I know if I've done that? The properly part of the docs makes me curious on that front

[abn]

The followig fields in the package metadata are what are required at the very least. This is the info field of https://pypi.org/pypi/{package}/json.

{
  ...
  "name": "poetry-core",
  ....
  "requires_dist": [
    "importlib-metadata (>=1.7.0,<2.0.0); python_version >= \"2.7\" and python_version < \"2.8\" or python_version >= \"3.5\" and python_version < \"3.8\"",
    "pathlib2 (>=2.3.5,<3.0.0); python_version >= \"2.7\" and python_version < \"2.8\"",
    "typing (>=3.7.4.1,<4.0.0.0); python_version >= \"2.7\" and python_version < \"2.8\"",
    "enum34 (>=1.1.10,<2.0.0); python_version >= \"2.7\" and python_version < \"2.8\"",
    "functools32 (>=3.2.3-2,<4.0.0); python_version >= \"2.7\" and python_version < \"2.8\""
  ],
  "requires_python": "...",
  "version": "1.0.3",
}

For requires_dist, we expect an array of PEP 508 entries, ideally with correct environment markers. Without the right markers the resolver might end up choosing incompatible versions. One common issue is the conditional population of install_requires in setup.py files based on build time environments leading to incorrect metadata. For example, missing windows dependencies if build environment was linux, or vice-versa; or the python version constraints not correctly being populated in package metadata, eg: importlib_metadata ; python <= '3.8'.

For release files, both md5 and sha256 checksums and package type are probably the most relevant after the url.