https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html # Direct dependencies 1. ✅ Gather direct dependencies - [`pyproject.toml`](https://packaging.python.org/en/latest/specifications/pyproject-toml/) - Extras/[optional dependencies](https://packaging.python.org/en/latest/specifications/pyproject-toml/#dependencies-optional-dependencies) - [Dependency groups](https://packaging.python.org/en/latest/specifications/dependency-groups/) - [Inline script metadata](https://packaging.python.org/en/latest/specifications/inline-script-metadata/) 2. [[Resolve dependency graph]] 3. Install distributions 1. Cache 2. Download # `pylock.toml` From https://packaging.python.org/en/latest/specifications/pylock-toml/#installation. 1. Gather the extras and dependency groups to install and set ``extras`` and ``dependency_groups`` for marker evaluation, respectively. 1. ``extras`` SHOULD be set to the empty set by default. 2. ``dependency_groups`` SHOULD be the set created from `default-groups` by default. 2. Check if the metadata version specified by `lock-version` is supported; an error or warning MUST be raised as appropriate. 3. If `requires-python` is specified, check that the environment being installed for meets the requirement; an error MUST be raised if it is not met. 4. If `environments` is specified, check that at least one of the environment marker expressions is satisfied; an error MUST be raised if no expression is satisfied. 5. For each package listed in `[[packages]]`: 1. If `packages.marker` is specified, check if it is satisfied; if it isn't, skip to the next package. 2. If `packages.requires-python` is specified, check if it is satisfied; an error MUST be raised if it isn't. 3. Check that no other conflicting instance of the package has been slated to be installed; an error about the ambiguity MUST be raised otherwise. 4. Check that the source of the package is specified appropriately (i.e. there are conflicting sources in the package entry); an error MUST be raised if any issues are found. 5. Add the package to the set of packages to install. 6. For each package to be installed: - If `[packages.vcs]` is set: 1. Clone the repository to the commit ID specified in `packages.vcs.commit-id`. 2. Build the package, respecting `packages.vcs.subdirectory`. 3. Install. - Else if `[packages.directory]` is set: 1. Build the package, respecting `packages.directory.subdirectory`. 2. Install. - Else if `[packages.archive]` is set: 1. Get the file. 2. Validate using `packages.archive.size` and `packages.archive.hashes`. 3. If the archive is a source tree or source distribution, build the package while respecting `packages.archive.subdirectory`. 4. Install. - Else if there are entries for `[[packages.wheels]]`: 1. Look for the appropriate wheel file based on `packages.wheels.name`; if one is not found then move on to `[packages.sdist]` or an error MUST be raised about a lack of source for the project. 2. Get the file: - If `packages.wheels.path` is set, use it. - Else if `packages.wheels.url` is set, try to use it; optionally tools MAY use `packages.index` or some tool-specific mechanism to download the selected wheel file (tools MUST NOT try to change what wheel file to download based on what's available; what file to install should be determined in an offline fashion for reproducibility). - If `packages.index` and `[[packages.attestation-identities]]` are set, verify that one of the attestations recorded in `[[packages.attestation-identities]]` matches the attestation for the file found at `packages.index` 3. Validate using `packages.wheels.size` and `packages.wheels.hashes`. 4. Install. - Else if no `[[packages.wheels]]` file is found or `[packages.sdist]` is solely set: 1. Get the file. - If `packages.sdist.path` is set, use it. - Else if `packages.sdist.url` is set, try to use it; tools MAY use `packages.index` or some tool-specific mechanism to download the file. - If `packages.index` and `[[packages.attestation-identities]]` are set, verify that one of the attestations recorded in `[[packages.attestation-identities]]` matches the attestation for the file found at `packages.index` 2. Validate using `packages.sdist.size` and `packages.sdist.hashes`. 3. Build the package. 4. Install.