# Data flow — pypa/pip

> Canonical page: https://codevetter.com/unpack/pip/data-flow

# Data flow — pypa/pip

Scanned commit a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6 (2026-09-23). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Inputs become typed installation requirements through shared command infrastructure. Discovery supplies candidates, and resolution uses metadata and constraints to select concrete distributions. Preparation records artifact paths and provenance before installation writes into an environment scheme. Configuration and caches provide independent persistence paths with their own precedence and identity rules.
- ConfigOptionParser loads Configuration before deriving defaults, applies global, command-specific, then environment sections, and validates string defaults through each option's type checker. — [src/pip/_internal/cli/parser.py#L226-L255](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/cli/parser.py#L226-L255) [src/pip/_internal/cli/parser.py#L321-L341](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/cli/parser.py#L321-L341)
- get_requirements() collects constraints, converts CLI strings and editables into InstallRequirement objects, expands dependency groups, and turns parsed requirements-file entries into user-supplied requirements with config settings. — [src/pip/_internal/cli/req_command.py#L319-L359](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/cli/req_command.py#L319-L359) [src/pip/_internal/cli/req_command.py#L383-L396](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/cli/req_command.py#L383-L396)
- RequirementsFileParser recursively resolves nested -r/-c references relative to URLs or local files and rejects recursion; get_file_content() reads HTTP, HTTPS, file URLs, or bare filesystem paths. — [src/pip/_internal/req/req_file.py#L350-L398](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/req/req_file.py#L350-L398) [src/pip/_internal/req/req_file.py#L563-L593](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/req/req_file.py#L563-L593)
- PackageFinder.find_all_candidates() combines evaluated local-file candidates with page candidates and caches the result; a known locked link bypasses those sources and fails immediately if link evaluation rejects it. — [src/pip/_internal/index/package_finder.py#L879-L917](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/index/package_finder.py#L879-L917) [src/pip/_internal/index/package_finder.py#L919-L952](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/index/package_finder.py#L919-L952)
- Factory.collect_root_requirements() canonicalizes and intersects matching constraints, tracks user-requested order, and sorts extra-bearing requirements last; Resolver passes these collections into PipProvider and resolvelib. — [src/pip/_internal/resolution/resolvelib/factory.py#L544-L584](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/resolution/resolvelib/factory.py#L544-L584) [src/pip/_internal/resolution/resolvelib/resolver.py#L79-L105](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/resolution/resolvelib/resolver.py#L79-L105)
- Preparation can fetch sidecar metadata and defer full artifacts; full preparation populates local_file_path and DirectUrl provenance, computes a missing source SHA-256, and compares wheel metadata against a previously used sidecar. — [src/pip/_internal/operations/prepare.py#L620-L637](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/operations/prepare.py#L620-L637) [src/pip/_internal/operations/prepare.py#L727-L763](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/operations/prepare.py#L727-L763) [src/pip/_internal/operations/prepare.py#L765-L783](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/operations/prepare.py#L765-L783)
- InstallRequirement.install() derives an installation scheme and forwards the wheel, direct origin, and user-requested flag; wheel installation generates launchers and persists INSTALLER, optional direct_url.json and REQUESTED, and rewritten RECORD rows. — [src/pip/_internal/req/req_install.py#L782-L806](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/req/req_install.py#L782-L806) [src/pip/_internal/operations/install/wheel.py#L671-L679](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/operations/install/wheel.py#L671-L679) [src/pip/_internal/operations/install/wheel.py#L695-L735](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/operations/install/wheel.py#L695-L735)
- Wheel-cache identity includes the source URL, available hash, subdirectory, and interpreter name/version; HTTP caching uses SafeFileCache adapters, while Configuration tracks parser mutations and saves them to selected INI paths. — [src/pip/_internal/cache.py#L44-L75](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/cache.py#L44-L75) [src/pip/_internal/network/session.py#L373-L388](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/network/session.py#L373-L388) [src/pip/_internal/configuration.py#L159-L177](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/configuration.py#L159-L177) [src/pip/_internal/configuration.py#L213-L230](https://github.com/pypa/pip/blob/a7002c9771a6c3f0317a4e6b9fbdcd22e643f7b6/src/pip/_internal/configuration.py#L213-L230)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)