Poetry solves --without dependency group

[mripani]

I have a group which is called ssh so when installing my project within a Dockerfile I can use --without ssh command and avoid installing the group of dependency that requires an SSH key.

Even though within my Dockerfile I use the command --without in order to avoid that specific group, the dependency solver still tries to solve those dependency and fails because of no permissions.

Is it the normal poetry behavior that even solves the dependency conflicts of those avoided groups?

Here is an example of the code:

RUN poetry config virtualenvs.create true \
    && poetry config virtualenvs.in-project true \
    && poetry install --without ssh --sync \
    && poetry lock

This is an example of the pyproject.toml that I try to install

[tool.poetry]
name = "my-package"
version = "0.1.0"
description = "My project"
authors = ["[email protected]"]


[tool.poetry.dependencies]
python = "~3.11"

[tool.poetry.group.ssh.dependencies]
my-private-project1 = { git = "ssh://[email protected]/myorg/myrepo1.git", rev = "main" }
my-private-project2 = { git = "ssh://[email protected]/myorg/myrepo2.git", rev = "main" }

Poetry version: poetry=1.8.3

[dimbleby]

yes (how else would it know what to put in the lock file?)

[mripani]

I was wondering that it may only put in the lock file the installed packages, instead of using them all. Can I avoid solving dependencies for a specified group?

My problem arises because I have nested private packages, so there is a package that installs another package through SSH, I couldn't find a way to use the SSH in the nested private package (I do know how to do it with the first private package, but not the nested one).

[dimbleby]

Can I avoid solving dependencies for a specified group?

no

if you do not want to solve from inside your docker build then just don't: lock ahead of time and copy the poetry.lock file in.

[mripani]

I already tried copying the lock file in, but still getting a permissions problem.

[dimbleby]

if you don't share a way to reproduce what you are seeing I expect no-one can help you

I notice that the dockerfile you have provided does not match up with your description, perhaps you are not being careful

[mripani]

I understand, it's complicated to reproduce the situation due to the private repos.

[radoering]

I think your understanding of poetry lock and poetry install is not correct. In your docker snippet, you run poetry lock after poetry install, which normally does not make any sense. poetry install installs dependencies from a lock file or - if there is none - creates one first and then installs dependencies from this lock file. Locking requires access to all dependencies of all groups. Installing (with an existing lock file) should only require access to the dependencies of the groups that are installed.

[radoering]

Of course? If A depends on B, then installing A results in installing B because both are in the same group?

[mripani]

While using --without group of SSH none of the packages under SSH group should be installed. Instead poetry still trys to resolve the dependencies of package A and B and fails because of nested private dependency.

[finswimmer]

Are you sure you've included the poetry.lock file in your image?

[mripani]

Yes I tried including it. But it still ask for authentication for the nested private repository while installing.

[dimbleby]

I am quite sure that you are either misunderstanding or misreporting what is happening. But since you are unable or unwilling to provide a reproduction it is too hard to guess which, and in what way.

Good luck.