option to only parse declarative dependency specifications (eg not execute setup.py)

[graingert]

Currently when executing pip-compile you are forced to download and execute untrusted python code (setup.py), however it's possible to determine dependency versions without executing setup.py for wheel packages and those using setup.cfg declarative metadata https://setuptools.readthedocs.io/en/latest/setuptools.html#configuring-setup-using-setup-cfg-files

There should be an option to only parse dependencies from declarative sources eg wheel and setup.cfg. and never execute any "setup.py" files

[atugushev]

Hello @graingert,

Is there an option in pip to achieve this when you install a package?

[atugushev]

@graingert does pip-compile --pip-args '--only-binary :all:' resolve the issue?

[webknjaz]

I wonder if this could build on top of #1681 later on.