CodeVetter · Repo Unpack · System map
pypa/pip
pip runs as a local CLI process, with additional process boundaries for alternate interpreters, build hooks, and VCS tools. Maintained implementation code lives under _internal, while dependencies are vendored under _vendor. Persistent state is spread across Python installation schemes, configuration files, and caches. Packaging and repository automation are defined separately from runtime command dispatch.
- The root project is named pip, requires Python >=3.10, and exposes pip and pip3 console scripts through pip._internal.cli.main:main; python -m pip delegates to the same function.
- commands_dict maps command names to module paths, classes, and summaries; create_command() imports only the selected module, and Command.main() provides the execution context.
- The architecture distinguishes maintainer-written _internal code from vendored dependencies; direct use of internals is unsupported. Vendoring configuration specifies a namespace, protected files, patches, and an SBOM.
- RequirementCommand constructs preparers and resolvers, while the resolvelib Resolver combines Factory, PipProvider, and a reporter before producing a RequirementSet and installation order.
- Filesystem state has separate owners: wheel installation writes distribution metadata and RECORD, Cache derives artifact directories, and Configuration writes selected INI files outside the checkout.
- External integration boundaries include requests-based PipSession adapters, VCS subprocess execution, and BuildBackendHookCaller instances configured with source directories and build-environment interpreters.
- Flit builds the distribution; build-project.py provisions pinned, hashed build requirements and sets SOURCE_DATE_EPOCH. Nox drives tests, while tag-triggered release automation builds artifacts and publishes through PyPI trusted publishing.
- Maintenance workflows lock inactive closed threads, validate PR checklist bodies, refresh the build lock through a PR, and synchronize documentation redirects using an environment-provided RTD token.