where to find version of packages used to build a specific installed package

[ninousf]

hi
i need to reproduce exactly the same environment of an old project.
i supposed the requirements.txt file was enough, but no.
for example, when installing cbor2==5.0.1, it needs setuptools_scm > 6.4 as build dependencies. But the build process crashed with the last setuptools_scm and print:
ERROR: setuptools==41.2.0 is used in combination with setuptools_scm>=6.x
OK so in the origin environment, how can i find which version setuptools_scm was used to build cbor2 package ?
thanks

[webknjaz]

You can't, unless the upstream publishes this information, or pins the deps for building. But from your error it seems like you might want to update setuptools or downgrade setuptools-scm. pyproject.toml usually contains the build deps with the minimal versions of the deps required for building so maybe stick with those.

[ninousf]

in terms of reproducibility, it's dangerous no ?
I do not want to update any package because the env. is in production.
This means that we need a additional requirements file too, for build (build_requirements.txt) .
I find the solution by looking the creation date of the cbor2-5.0.1-py3.6.egg-info in the origin env. and installed the corresponding setuptools_scm version at the same date (3.3.3)
so it works if i do:
pip install setuptools_scm==3.3.3
pip install -r requirements.txt
:(

[webknjaz]

I was talking about the PEP 517 driven build, which is configured in pyproject.toml. You are not expected to install any build deps separately, nor invoke the deprecated setup.py. Just using python -m build should build it.

As for the dependency pinning, that's a good idea. I've been exploring it, but there's no official standard for dealing with the build deps.
pypa/build uses pip install in an isolated virtualenv to install the build requirements. Typically, people would just use >= but sometimes both >= and <. Because of this implementation detail, I've found that it's possible to use a constraints file by declaring it via an env var that pip understands.
I'm experimenting with this in the Cheroot project with https://github.com/cherrypy/cheroot/blob/main/requirements/dist-build-constraints.txt and calling the build as PIP_CONSTRAINT=requirements/dist-build-constraints.txt python -m build. I've generated this file using python3 -c 'from pathlib import Path; from sys import argv; from tomli import loads; print("\n".join(loads(Path(argv[1]).read_text())["build-system"].get("requires", [])))' pyproject.toml | python3 -m piptools compile -P cython --allow-unsafe --strip-extras --output-file requirements-build.txt -.
Talking about pip-tools, I've also made a feature request there to simplify the process, it's here jazzband/pip-tools#1396.

[ninousf]

thanks webknajz.
your solution has to be done before installing the package in a new environment.
But suppose that i have a current env. with plenty of installed packages. From this env., i can not reconstruct a requirements.txt and a constraints.txt file in order to rebuild a new cloned env. elsewhere ?
there are no logs somewhere in the current env. to known exactly what happened during install ?
the only solution is to tar.gz all the current env. and copy/paste ?
trassability is missing

[webknjaz]

FWIW the build deps aren't even supposed to be in your env unless they are also your runtime deps.

[webknjaz]

Also, you seem to be confusing building and installing. The depresolver+install logs would belong somewhere in pip, not in a build backend.