More respectful convention for caching

[aanghelidi]

A PR that aims to close #342.

All the logic is inside _get_internal_cache_path in _cache.py.

[woodruffw]

Thanks @aanghelidi, this looks pretty reasonable to me. pip-audit's choice of cache location isn't a stability commitment we make, so we should be fine to change this without making a major release.

A couple of thoughts:

• Maybe we could use platformdirs to abstract the cache location discovery for us? OTOH the current logic in _get_internal_cache_path is pretty simple; curious what you think.
• Maybe we should blow away the old cache if a new path is discovered? Otherwise, users will end up silently keeping _PIP_AUDIT_INTERNAL_CACHE around in their $HOME taking up space, which isn't very polite of us.

For the second point, something like this is what I have in mind:

# if the selected internal cache isn't the old one, delete the old one.
if internal_cache_path != _PIP_AUDIT_LEGACY_INTERNAL_CACHE:
    shutil.rmtree(_PIP_AUDIT_LEGACY_INTERNAL_CACHE)

CC @di for thoughts as well 🙂

[aanghelidi]

Thanks @woodruffw for the review 🙂 TIL about platformdirs ! This is indeed a really handy package. Regarding the aforementioned points:

• There is several pros about using platformdirs:

  • simplicity. Using platformdirs, the implementation of pip-audit's cache location is a one-liner.
  • we do not reinvent the wheel. This means less maintenance for the project.
  • consistency. Upon research, it seems that platformdirs is already used in several pypa projects:
    • hatch: see here
    • pipx: see here
    • setuptools: see here (as a vendored library)

• Regarding the potential con(s):

  • dependency cost. We add one more dependency to the project. Although platformdirs itself has no dependencies, it's still a decision to make. Maybe this is not worth adding given the simplicity of _get_internal_cache_path implementation (which I have the feeling could be simplified).

• Regarding PIP_AUDIT_INTERNAL_CACHE, it is indeed not nice to keep the old cache in $HOME. Removing it seems to be a good idea. Maybe, as an alternative, using shutil.move to move the old cache to the new location could be an idea?

I added a commit using platformdirs for the cache location, let me know what you think 🙂

[woodruffw]

• Regarding PIP_AUDIT_INTERNAL_CACHE, it is indeed not nice to keep the old cache in $HOME. Removing it seems to be a good idea. Maybe, as an alternative, using shutil.move to move the old cache to the new location could be an idea?

I think we should just blow it away for now -- #794 covers some larger architectural changes we need to make to handle newer versions of pip's cache anyways, so these old paths may not be super useful when moved to the new location.

I added a commit using platformdirs for the cache location, let me know what you think 🙂

LGTM, thank you!

[aanghelidi]

I think we should just blow it away for now -- #794 covers some larger architectural changes we need to make to handle newer versions of pip's cache anyways, so these old paths may not be super useful when moved to the new location

Thank you for the context @woodruffw ! I added a extra commit to delete the old cache that goes into that direction. Let me know what you think 🙂

[woodruffw]

No need for a helper here; let's just inline this into _get_cache_dir IMO.

[aanghelidi]

The last commit now inline the deletion into _get_cache_dir ✔️

[woodruffw]

Thanks @aanghelidi, LGTM!

[woodruffw]

Sorry, one last request: could you add a CHANGELOG entry for this change? See the other entries in the log for our preferred style.