This PEP specifies how to write a project’s core metadata in a pyproject.toml file for packaging-related tools to consume.
The key motivators of this PEP are:
To speak specifically to the motivation for static metadata, that has been an overall goal of the packaging ecosystem for some time. As such, making it easy to specify metadata statically is important. This also means that raising the cost of specifying data as dynamic is acceptable as users should skew towards wanting to provide static metadata.
Requiring the distinction between static and dynamic metadata also helps with disambiguation for when metadata isn’t specified. When any metadata may be dynamic, it means you never know if the absence of metadata is on purpose or because it is to be provided later. By requiring that dynamic metadata be specified, it disambiguates the intent when metadata goes unspecified.
This PEP does not attempt to standardize all possible metadata required by a build back-end, only the metadata covered by the core metadata specification which are very common across projects and would stand to benefit from being static and consistently specified. This means build back-ends are still free and able to innovate around patterns like how to specify the files to include in a wheel. There is also an included escape hatch for users and build back-ends to use when they choose to partially opt-out of this PEP (compared to opting-out of this PEP entirely, which is also possible).
This PEP is also not trying to change the underlying core metadata in any way. Such considerations should be done in a separate PEP which may lead to changes or additions to what this PEP specifies.
The design guidelines the authors of this PEP followed were:
When specifying project metadata, tools MUST adhere and honour the metadata as specified in this PEP. If metadata is improperly specified then tools MUST raise an error to notify the user about their mistake.
Data specified using this PEP is considered canonical. Tools CANNOT remove, add or change data that has been statically specified. Only when a field is marked as dynamic may a tool provide a “new” value.
Tools MUST specify fields defined by this PEP in a table named [project]. No tools may add fields to this table which are not defined by this PEP or subsequent PEPs. For tools wishing to store their own settings in pyproject.toml, they may use the [tool] table as defined in PEP 518. The lack of a [project] table implicitly means the build back-end will dynamically provide all fields.
The name of the project.
Tools MUST require users to statically define this field.
Tools SHOULD normalize this name, as specified by PEP 503, as soon as it is read for internal consistency.
The version of the project as supported by PEP 440.
Users SHOULD prefer to specify already-normalized versions.
The summary description of the project.
The full description of the project (i.e. the README).
The field accepts either a string or a table. If it is a string then it is the relative path to a text file containing the full description. Tools MUST assume the file’s encoding is UTF-8. If the file path ends in a case-insensitive .md suffix, then tools MUST assume the content-type is text/markdown. If the file path ends in a case-insensitive .rst, then tools MUST assume the content-type is text/x-rst. If a tool recognizes more extensions than this PEP, they MAY infer the content-type for the user without specifying this field as dynamic. For all unrecognized suffixes when a content-type is not provided, tools MUST raise an error.
The readme field may also take a table. The file key has a string value representing a relative path to a file containing the full description. The text key has a string value which is the full description. These keys are mutually-exclusive, thus tools MUST raise an error if the metadata specifies both keys.
A table specified in the readme field also has a content-type field which takes a string specifying the content-type of the full description. A tool MUST raise an error if the metadata does not specify this field in the table. If the metadata does not specify the charset parameter, then it is assumed to be UTF-8. Tools MAY support other encodings if they choose to. Tools MAY support alternative content-types which they can transform to a content-type as supported by the core metadata. Otherwise tools MUST raise an error for unsupported content-types.
The Python version requirements of the project.
The table may have one of two keys. The file key has a string value that is a relative file path to the file which contains the license for the project. Tools MUST assume the file’s encoding is UTF-8. The text key has a string value which is the license of the project whose meaning is that of the License field from the core metadata. These keys are mutually exclusive, so a tool MUST raise an error if the metadata specifies both keys.
A practical string value for the license key has been purposefully left out to allow for a future PEP to specify support for SPDX expressions (the same logic applies to any sort of “type” field specifying what license the file or text represents).
The people or organizations considered to be the “authors” of the project. The exact meaning is open to interpretation — it may list the original or primary authors, current maintainers, or owners of the package.
The “maintainers” field is similar to “authors” in that its exact meaning is open to interpretation.
These fields accept an array of tables with 2 keys: name and email. Both values must be strings. The name value MUST be a valid email name (i.e. whatever can be put as a name, before an email, in RFC 822) and not contain commas. The email value MUST be a valid email address. Both keys are optional.
Using the data to fill in core metadata is as follows:
The keywords for the project.
Trove classifiers which apply to the project.
A table of URLs where the key is the URL label and the value is the URL itself.
There are three tables related to entry points. The [project.scripts] table corresponds to the console_scripts group in the entry points specification. The key of the table is the name of the entry point and the value is the object reference.
The [project.gui-scripts] table corresponds to the gui_scripts group in the entry points specification. Its format is the same as [project.scripts].
The [project.entry-points] table is a collection of tables. Each sub-table’s name is an entry point group. The key and value semantics are the same as [project.scripts]. Users MUST NOT create nested sub-tables but instead keep the entry point groups to only one level deep.
Build back-ends MUST raise an error if the metadata defines a [project.entry-points.console_scripts] or [project.entry-points.gui_scripts] table, as they would be ambiguous in the face of [project.scripts] and [project.gui-scripts], respectively.
The (optional) dependencies of the project.
For dependencies, it is a key whose value is an array of strings. Each string represents a dependency of the project and MUST be formatted as a valid PEP 508 string. Each string maps directly to a Requires-Dist entry in the core metadata.
For optional-dependencies, it is a table where each key specifies an extra and whose value is an array of strings. The strings of the arrays must be valid PEP 508 strings. The keys MUST be valid values for the Provides-Extra core metadata. Each value in the array thus becomes a corresponding Requires-Dist entry for the matching Provides-Extra metadata.
Specifies which fields listed by this PEP were intentionally unspecified so another tool can/will provide such metadata dynamically. This clearly delineates which metadata is purposefully unspecified and expected to stay unspecified compared to being provided via tooling later on.
As this provides a new way to specify a project’s core metadata and is using a new table name which falls under the reserved namespace as outlined in PEP 518, there are no backwards-compatibility concerns.
There are no direct security concerns as this PEP covers how to statically define project metadata. Any security issues would stem from how tools consume the metadata and choose to act upon it.
There are currently no proofs-of-concept from any build back-end implementing this PEP.
There was worry that using this table name would exacerbate confusion between build metadata and project metadata, e.g. by using [build-system.metadata] as a table.
Garnered no strong support.
The strongest contender after [project], but in the end it was agreed that [project] read better for certain sub-tables, e.g. [project.urls].
Initially there was a proposal to add a middle layer between the static metadata specified by this PEP and prepare_metadata_for_build_wheel() as specified by PEP 517. The idea was that if a project wanted to insert itself between a build back-end and the metadata there would be a hook to do so.
In the end the authors considered this idea unnecessarily complicated and would move the PEP away from its design goal to push people to define core metadata statically as much as possible.
While it would make things easier for tools to only work with the normalized name as specified in PEP 503, the idea was ultimately rejected as it would hurt projects transitioning to using this PEP.
The authors decided fairly quickly during design discussions that this PEP should focus exclusively on project metadata and not build metadata. As such, specifying what files should end up in a source distribution or wheel file is out of scope for this PEP.
This suggestion came thanks to the corresponding core metadata being Project-Url. But once the overall table name of [project] was chosen, the redundant use of the word “project” suggested the current, shorter name was a better fit.
While the core metadata supports it, having a single field for a project’s URL while also supporting a full table seemed redundant and confusing.
As various tools have grown the concept of required dependencies versus development dependencies, the idea of suggesting to tools that they put such development tool into a “dev” grouping came up. In the end, though, the authors deemed it out-of-scope for this specification to suggest such a workflow.
The authors considered the idea that the dynamic field would only require the listing of missing required fields and make listing optional fields optional. In the end, though, this went against the design goal of promoting specifying as much information statically as possible.
The readme field had a proposed readme_content_type field, but the authors considered the string/table hybrid more practical for the common case while still accommodating the more complex case. Same goes for using long_description and a corresponding long_description_content_type field.
The file key in the table format was originally proposed as path, but file corresponds to setuptools’ file key and there is no strong reason otherwise to choose one over the other.
The authors considered allowing for unspecified content-types which would default to text/plain, but decided that it would be best to be explicit in this case to prevent accidental incorrect renderings on PyPI and to force users to be clear in their intent.
The authors originally proposed requires/extra-requires as names, but decided to go with the current names after a survey of other packaging ecosystems showed Python was an outlier:
Normalizing on the current names helps minimize confusion for people coming from other ecosystems without using terminology that is necessarily foreign to new programmers. It also prevents potential confusion with requires in the [build-system] table as specified in PEP 518.
As the difference between Authors and Maintainers fields in the core metadata is unspecified and ambiguous, this PEP originally proposed unifying them as a single authors field. Other ecosystems have selected “author” as the term to use, so the thinking was to standardize on Author in the core metadata as the place to list people maintaining a project.
In the end, though, the decision to adhere to the core metadata was deemed more important to help with the acceptance of this PEP, rather than trying to introduce a new interpretation for some of the core metadata.
There was a worry that keeping project.entry-points to a depth of 1 for sub-tables would cause confusion to users if they use a dotted name and are not used to table names using quotation marks (e.g. project.entry-points."spam.magical"). But supporting an arbitrary depth – e.g. project.entry-points.spam.magical – would preclude any form of an exploded table format in the future. It would also complicate things for build back-ends as they would have to make sure to traverse the full table structure rather than a single level and raising errors as appropriate on value types.
The format for specifying the dependencies of a project was the most hotly contested topic in terms of data format. It led to the creation of both PEP 631 and PEP 633 which represent what is in this PEP and using TOML dictionaries more extensively, respectively. The decision on those PEPs can be found at https://discuss.python.org/t/how-to-specify-dependencies-pep-508-strings-or-a-table-in-toml/5243/38.
The authors briefly considered supporting both formats, but decided that it would lead to confusion as people would need to be familiar with two formats instead of just one.
When this PEP was written, sdists did not require having static, canonical metadata like this PEP does. The idea was then considered to use this PEP as a way to get such metadata into sdists. In the end, though, the idea of updating pyproject.toml was not generally liked, and so the idea was rejected in favour of separately pursuing standardizing metadata in sdists.
In an earlier version of this PEP, tools were allowed to extend data for fields. For instance, build back-ends could take the version number and add a local version for when they built the wheel. Tools could also add more trove classifiers for things like the license or supported Python versions.
In the end, though, it was thought better to start out stricter and contemplate loosening how static the data could be considered based on real-world usage.
None at the moment.
This document is placed in the public domain or under the CC0-1.0-Universal license, whichever is more permissive.
Source: https://github.com/python/peps/blob/main/peps/pep-0621.rst
Last modified: 2025-02-01 08:55:40 UTC