Unexpected conflict between requirements and constraints file

[eshenayo]

Description

Encountering an unexpected error while running: python3.11 -m pip install -r requirements.txt -c constraints.txt

In the requirements.txt file line 6 is just faster_whisper the constraints file has the line:
whisper-timestamped @ git+https://github.com/linto-ai/whisper-timestamped@b8cfd26ac0109b84d3252638ad882ab77e0dba2e
When the constraints file is changed to be a version instead of git url, the error resolves.

Expected behavior

That @ urls are respected in the constraints.txt file.

pip version

24.3.1

Python version

3.11

OS

Ubuntu 22.04

How to Reproduce

1. Create a requirements.txt file with the contents:
   git+https://github.com/linto-ai/whisper-timestamped git+https://github.com/openai/whisper.git git+https://github.com/suno-ai/bark.git
2. Create a constraints.txt file with the contents:
   openai-whisper @ git+https://github.com/openai/whisper.git@90db0de1896c23cbfaf0c58bc2d30665f709f170 suno-bark @ git+https://github.com/suno-ai/bark.git@f4f32d4cd480dfec1c245d258174bc9bde3c2148 whisper-timestamped @ git+https://github.com/linto-ai/whisper-timestamped@b8cfd26ac0109b84d3252638ad882ab77e0dba2e
3. Run: python3 -m pip install -r requirements.txt -c constraints.txt

Output

Output:

 11.44 Collecting faster_whisper (from -r requirements.txt (line 6))
11.47   Downloading faster_whisper-1.1.0-py3-none-any.whl.metadata (16 kB)
11.49 ERROR: Cannot install whisper-timestamped 1.15.8 (from git+https://github.com/linto-ai/whisper-timestamped) because these package versions have conflicting dependencies.
11.49
11.49 The conflict is caused by:
11.49     The user requested whisper-timestamped 1.15.8 (from git+https://github.com/linto-ai/whisper-timestamped)
11.49     The user requested (constraint) whisper-timestamped
11.49
11.49 To fix this you could try to:
11.49 1. loosen the range of package versions you've specified
11.49 2. remove package versions to allow pip to attempt to solve the dependency conflict
11.49
11.54 ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[notatallshaw]

I haven't done a careful review of the constraint code involved, but I'm fairly confident the issue here is that the design of constraints within pip is that they should not cause anything to additionally be downloaded and/or built by themselves.

Using a link to a source tree (whether it be a file directory or a VCS link) means that pip would need to download and build the source to extract the name and/or version and make sure it is compliant with the requirement, regardless of whether it matches the requirement or not.

I think the easiest solution for now is to throw a more helpful error immediately if a user specifies either of these in the constraints file, although I've not looked at how the current requirement parser handles the differences between requirement files and constraints.

But I will try and make some time to take a look at this in more detail.

[notatallshaw]

Another reason I don't think this would be trivial to support, is that this use case is supported by uv but in a completely different way.

They have a "sources" feature that let's you define where a package should be sourced from: https://docs.astral.sh/uv/concepts/projects/workspaces/#workspace-sources, e.g.

[tool.uv.sources]
tqdm = { git = "https://github.com/tqdm/tqdm" }

This makes me think that this use case does not fit into the "constraints" model, and we would be better off erroring out early.

[eshenayo]

I haven't done a careful review of the constraint code involved, but I'm fairly confident the issue here is that the design of constraints within pip is that they should not cause anything to additionally be downloaded and/or built by themselves.

Using a link to a source tree (whether it be a file directory or a VCS link) means that pip would need to download and build the source to extract the name and/or version and make sure it is compliant with the requirement, regardless of whether it matches the requirement or not.

I think the easiest solution for now is to throw a more helpful error immediately if a user specifies either of these in the constraints file, although I've not looked at how the current requirement parser handles the differences between requirement files and constraints.

But I will try and make some time to take a look at this in more detail.

I see. That makes sense. I would request an update to documentation to be clear on the support as I generated a constraints file based on the output of pip freeze as recommended here: https://pip.pypa.io/en/stable/user_guide/#requirements-files

[notatallshaw]

I agree the docs can be improved around here, but I would note that the user guide does not recommend output the contents of pip freeze to a constraints file, it suggests it as a possibility for a requirements file, which should work.

PRs are welcome here, but if I have time I will take a look at adding an explicit error and updating the documentaiton.

[eshenayo]

If I have time, I'll make a PR for the docs update. Thanks for looking into this.