Hi everybody! I’m having a problem generating lockfiles for python, using

./pants generate-lockfiles --resolve=python-default

. I have

ca_certs_path = "/Users/a.../.ca_bundle/certs.pem"

added to pants.toml, but I still get

Updating dependencies
Resolving dependencies...

  SSLError

  HTTPSConnectionPool(host='<http://pypi.org|pypi.org>', port=443): Max retries exceeded with url: /pypi/prefect/json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)')))

  at ~/.cache/pants/named_caches/pex_root/venvs/s/268d4737/venv/lib/python3.7/site-packages/requests/adapters.py:517 in send

I have also set

export REQUESTS_CA_BUNDLE=...

to the same file with the certs, just in case. Is there any other setting I’m missing?

Hey Marko! I think this is a limitation of us using Poetry to generate lockfiles -- I don't think it's properly wired up here. There are several limitations with using Poetry, including that it doesn't support

--find-links

, so John has been leading a project for PEX to have lockfile support a la pip. When we can switch to Pex, we will have support or this auth automatically. Related question, are you using

[python-repos]

? In the meantime, some options: 1. Investigate what it would take to get this working with Poetry, keeping in mind it hopefully will go away in 2.11 2. Don't use Poetry to generate the lockfile (i.e.

./pants generate-lockfiles

). You can still use a lockfile by generating however you want and setting it up in

[python].resolves

, then setting

[python].invalid_lockfile_behavior = 'ignore'

I’m playing with my first pants project, so i actually think I don’t need this at all. Poetry at least is not involved. I may have gotten lost 🙂 Thanks for the reply!

To clarify, when you run

./pants generate-lockfiles

, under-the-hood we are using Poetry to do the lockfile generation. That is changing soon to Pex because of the limitations of Poetry, but isn't ready yet

What would be a good way to generate the lockfile manually, without using Poetry?

https://www.pantsbuild.org/docs/python-third-party-dependencies#user-lockfile has a table with several techniques, including the script included in the above link of

generate_constraints.txt

I got most of what I wanted to do done for now, and yes, things make more sense. Thanks

Is your machine a linux machine or a mac?

It's a mac (not m1). Thanks for the tip!