Support for Pipenv

[vpavlin]

We are looking at using cachito in our image builds and it seems like it only supports pip and requirements.txt dependency definition. Is there a plan to add support for Pipenv (Micropipenv) and Pipfile/Pipfile.lock tooling?

[fridex]

+1, it would be great to add support for Pipenv files (Pipenv is now under Python Packaging Association). micropipenv (a lightweight wrapper for pip to support also Pipenv files) can serve as an alternative - https://github.com/thoth-station/micropipenv The main issue with raw requirements.txt is reproducibility when requirements.txt many times do not state all the packages with digests (to check provenance and integrity of software installed).

micropipenv is also available in s2i container images that run Python 3.

[lcarva]

I agree! IMO it makes perfect sense to have this support in Cachito. If you're interested in contributing, I suggest starting by writing up an initial design describing how this can be achieved. Unfortunately, we don't have a concise guide on how to start. If it helps, the fetch_pip_source function is the entry point for processing a repo that uses the pip package manager.

[fridex]

Looking into sources, it looks like a major module rewrite as many parts are shared with micropipenv.