Installation log / package lock for mip

[aivarannamaa]

Currently mip does not record any metadata about installed packages. This means you can't easily recall, which versions of which distributions have been installed.

I propose changing mip to keep the log of installations in a file next to the installed packages. During each install, mip would open the file in append mode (so it doesn't need to worry about previous entries), record the requested package specifier together with the actual version / commit hash of the package and the target location (and possibly also the source URL) for each file that gets installed. This way the log file doubles as a lock-file for reproducible installs.

Reproducible installs would not be the only gain. If devices had such log/lock file, IDE-s could easily download the exact same dependencies (but *.py instead *.mpy) into local development folder for use by code analysis / completion. It would also allow for tools, which list, remove and update packages.

If such a thing is wanted by the community and acceptable by the maintainers, I can create a PR.

[Josverl]

I think this sh/could be split in 2:

1. Ability for mpremote mip to install from a requirements or lock file
2. Ability for mpremote mip to write / append to a requirements or lock file

My current work-around for 1 is to create a requirement-mip.ps1 or .sh batch file with multiple mpremote mip install xxx lines.

And possibly the same for the mip module, although I see less of a use case for that , and there would be firmware size implications.

[aivarannamaa]

I didn't think about adding the lock file only for mpremote mip, but this looks like a good idea. In this case it probably makes sense to create a normal lockfile, instead of append-only log. "package-lock.json" perhaps, considering MicroPython already uses "package.json"

[Josverl]

Pondering about something.json versus pyproject.toml 🤔

[aivarannamaa]

Adding a [tool.blah] section to pyproject.toml would be an option, but afaik, dependencies in project.dependencies, project.optional-dependencies and dependency-groups are assumed to be from PyPI namespace.

[Josverl]

Indeed, but poetry has been adding it's dependencies separately as well in prior versions.

So adding a [[tool.mip.dependencies]] should be fine