poetry build does not include locked transitive dependencies in METADATA/PKG-INFO

[BrandonLWhite]

• I am on the latest Poetry version.
• I have searched the issues of this repo and believe that this is not a duplicate.
• [N/A] If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

• OS version and name: Ubuntu 18.04.4
• Poetry version: 1.1.0a1

Issue

When generating a pip-installable package using poetry build, the resulting packages's metadata does not include all of the locked dependencies. Therefore, subsequent installation of the published package will not adhere to the pinned versions in the poetry.lock file.

Examining the Poetry source code, it seems that only the top-level dependencies from pyproject.toml are conveyed in the Requires-Dist: of the wheel METADATA and sdist PKG-INFO. This is probably desirable for library packages that are not standalone applications.

However, the use case I am currently dealing with involves command-line interface (CLI) tools meant to be installed using pipx (which isolates and runs in dedicated virtualenv). We are also using a private PyPI repository (JFrog/Artifactory) though that is irrelevant to the issue. The pip-tools pip-compile serves well in this regard -- the frozen requirements.txt feeds the setup.py sdist bdist_wheel operation and the locked/frozen/pinned dependency flattened tree lands in the METADATA/PKG-INFO. So users simply run pipx install foo-cli and get the exact package versions.

We're auditioning Poetry for our various workflows and this is blocking us from adopting Poetry for use with many of our applications where we need to publish the frozen requirements in the package meta.

In my opinion, Poetry's default behavior when building should be to use the lockfile's dependencies when generating the distribution. If a lock didn't the fallback would be to use pyproject.toml's deps (the current behavior). There could also be a --no-lock type option to control this behavior for the case where you want to publish libraries for reuse. The defaults could also be flipped around, where the current --no-lock remains the default and publishing the locked tree requires adding --lock.

[finswimmer]

Duplicate of #2778

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.