Read config for json api

docs/docs/project.md

@@ -132,5 +132,6 @@ by the configuration item `use_venv`, when it is set to `True`, PDM will use the
 | `python.use_pyenv` | Use the pyenv interpreter | `True` | Yes | |
 | `pypi.url` | The URL of PyPI mirror | Read `index-url` in `pip.conf`, or `https://pypi.org/simple` if not found | Yes | `PDM_PYPI_URL` |
 | `pypi.verify_ssl` | Verify SSL certificate when query PyPI | Read `trusted-hosts` in `pip.conf`, defaults to `True` | Yes | |
+| `pypi.json_api` | Consult PyPI's JSON API for package metadata | `True` | Yes | `PDM_PYPI_JSON_API` |
 
 *If the env var is set, the value will take precendence over what is saved in the config file.*

docs/docs/pyproject.md

@@ -97,9 +97,9 @@ myplugin = "mypackage.plugin:pytest_plugin"
 
 ## Build C extensions
 
-Currently building C extensions still rely on `setuptools`. You should write a python script which contains
-a function named `build` and accepts the arguments dictionary of `setup()` as the only parameter.
-In the function, update the dictionary with your `ext_modules` settings.
+Currently building C extensions still relies on `setuptools`. You should write a python script which contains
+a function named `build` and accepts the parameter dictionary of `setup()` as the only argument.
+Update the dictionary with your `ext_modules` settings in the function.
 
 Here is an example taken from `MarkupSafe`:
 

pdm/models/repositories.py

@@ -200,12 +200,10 @@ class PyPIRepository(BaseRepository):
         raise CandidateInfoNotFound(candidate)
 
     def dependency_generators(self) -> Iterable[Callable[[Candidate], CandidateInfo]]:
-        return (
-            self._get_dependencies_from_cache,
-            # PyPI JSON API seems not trustable
-            # self._get_dependencies_from_json,
-            self._get_dependencies_from_metadata,
-        )
+        yield self._get_dependencies_from_cache
+        if self.environment.project.config["pypi.json_api"]:
+            yield self._get_dependencies_from_json
+        yield self._get_dependencies_from_metadata
 
     def _find_named_matches(
         self,

pdm/project/config.py

@@ -86,6 +86,11 @@ class Config(MutableMapping):
         "pypi.verify_ssl": ConfigItem(
             "Verify SSL certificate when query PyPI", verify_ssl
         ),
+        "pypi.json_api": ConfigItem(
+            "Consult PyPI's JSON API for package metadata",
+            True,
+            env_var="PDM_PYPI_JSON_API",
+        ),
         "use_venv": ConfigItem(
             "Install packages into the activated venv site packages instead of PEP 582",
             False,