Mailman 3 July 2012 - Distutils-SIG

i have run the exe file, but it does not seem to work
by Menghsiu Lee 22 Jul '12

22 Jul '12

To whom it may concern: I read the response on the link below: http://www.mail-archive.com/distutils-sig@python.org/msg13767.html And I follow your instruction, but then the exe file has idled. The attachment is my screen cut. The complete file link is in below: http://dl.dropbox.com/u/63928380/blackjack.rar Best regards, menghsiu

2 1

strong hashing in RECORD and signed wheel files
by Daniel Holth 18 Jul '12

18 Jul '12

One of the main design goals for the wheel built package format is that a wheel archive extracted to sys.path is a PEP-376 compliant installation. I also want most wheel files to be cryptographically signed. The idea is to include a < 256 byte JSON Web Signature of RECORD, "RECORD.jws", which will only take a couple of milliseconds to generate, in the .dist-info directory. This is only meaningful if RECORD has strong hashes, or the installer would have to always rewrite RECORD on install just to include md5 sums to follow the spec. PyPi already lets you sign whole archives with GPG, but this scheme is more flexible because you can re-compress the .zip archive without invalidating signatures, you could use HTTP Range (partial content) requests to download and verify only the metadata of an archive without having to download the whole thing (this is one reason why .whl is a zip archive), and the whole system will be a bit more relaxed than GPG so that bdist_wheel can just generate signing keys automatically and an end user can decide whether to trust or distribute a particular key later -- perhaps a particular key would be valid per maintainer, or per distribution, or for only certain versions of a distribution. That's why I would like PEP 376 to understand hashes-besides-md5 in RECORD.

2 2

easy_install issues
by Fred G 14 Jul '12

14 Jul '12

Hi-- I was having some difficulties installing easy_install. I was following a tutorial that had me on the command prompt typing C:/easy_tutorial\ez_setup.py but in the tutorial this did something else then what my computer did. For me, a notepad file with a python script opened when I did this, instead of actually running anything. I've spent a good 2-3 hours looking at the easy_install documentation, downloading a free software to open .tar.gz files, opening various egg files and .py files, and haven't gotten anywhere really. Is there a very basic step-by-step guide for how to install it that doesn't come up in a google search for this? Or a good description that can explain things in an easy way? I have python 2.7.3 and would really like to get this module installed. Thanks in advance for any help you can provide.

2 2

distribute broken Python 3.3.3
by Jim Fulton 14 Jul '12

14 Jul '12

https://bitbucket.org/tarek/distribute/issue/289/distribute-broken-with-pyt… I'm gonna try to work around it in buildout 2 by monkey-patching distribute. Jim -- Jim Fulton http://www.linkedin.com/in/jimfulton Jerky is better than bacon! http://zo.pe/Kqm

3 6

Request: new zc.buildout release
by Martijn Pieters 13 Jul '12

13 Jul '12

Could we have a new release of zc.buildout please? 1.5.2 was released nearly 2 years ago, and trunk now contains some interesting bug fixes and new features. If there is something blocking a 1.6 release, could we see about branching off the 1.5.x line to at least push out the bug fixes? -- Martijn Pieters www.zopatista.com

3 5

[issue142] easy_install ignores 'headers' passed to setup()
by Tres Seaver 09 Jul '12

09 Jul '12

New submission from Tres Seaver <tseaver(a)palladion.com>: A bare distutils install of a package with 'headers' passed to 'setup()' dispatches to 'install_headers', which copies the exported header files into the system include path. 'easy_install' bypasses the distutils 'install()' when doing a normal egg install, and does not re-implement the 'install_headers' dance. Furthermore, the 'bdist_egg' it creates, even though it contains the header files, has no metadata which would allow the installer to discover that they should be copied. ---------- messages: 669 nosy: tseaver priority: bug status: unread title: easy_install ignores 'headers' passed to setup() _______________________________________________ Setuptools tracker <setuptools(a)bugs.python.org> <http://bugs.python.org/setuptools/issue142> _______________________________________________

2 1

[issue141] Setuptools looks for dependencies even when installed
by fonnesbeck 07 Jul '12

07 Jul '12

New submission from fonnesbeck <fonnesbeck(a)gmail.com>: When installing a package using setuptools, the installer looks for and tries to install dependencies even when they are already satisfied. For example, a package that requires scipy (no version requirement specified) looks for a version online even though I have a very current version already installed: Processing dependencies for mcex==0.1 Searching for scipy Reading http://pypi.python.org/simple/scipy/ Reading http://www.scipy.org Reading http://sourceforge.net/project/showfiles.php?group_id=27747&package_id=19531 Reading http://new.scipy.org/Wiki/Download Best match: scipy 0.10.1 ---------- messages: 664 nosy: fonnesbeck priority: bug status: unread title: Setuptools looks for dependencies even when installed _______________________________________________ Setuptools tracker <setuptools(a)bugs.python.org> <http://bugs.python.org/setuptools/issue141> _______________________________________________

1 0

Proposal: drop md5 for sha256
by Jennings, Jared L CTR USAF AFMC 46 SK/CCI 05 Jul '12

05 Jul '12

On hosts configured for compliance with U.S. Federal Information Processing Standard (FIPS) 140-2 <http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf>, like those in some banks and, yes, the U.S. Department of Defense, cryptographic modules (such as OpenSSL, which underlies hashlib) are not allowed to calculate MD5 digests, because MD5 is no longer a FIPS Approved digest algorithm. I know no one is trying here to lean on MD5 for security, but the standard says nothing about the reason why you're using MD5: just that you can't. No one expects a digest algorithm to fail, and Python 2.x may not have been fixed to check for that before being frozen <https://bugzilla.redhat.com/show_bug.cgi?id=746118#c3>, so if you run an MD5 checksum on a FIPS-compliant system with an unpatched Python 2.x, the Python interpreter will segfault. (Ruby, too, had this problem and was itself only recently fixed, <http://bugs.ruby-lang.org/issues/4944>.) I have to configure hosts in accordance with FIPS 140-2, so the more places I can get rid of MD5, the less headaches I have. -- Jared Jennings, RHCE, Network Admin, SURVICE Engineering Co.

8 10

[issue140] [PATCH] Make 'develop --egg-path' respect specified path in easy_install.pth
by R. Andrew Ohana 04 Jul '12

04 Jul '12

New submission from R. Andrew Ohana <andrew.ohana(a)gmail.com>: Currently easy_install.pth will either contain paths relative to the site-packages directory, or the normalized_path. This is because the framework has been setup to use normalized paths everywhere. The patch should properly extend the current framework to make the argument to the egg-path option actually respected. ---------- files: respect-egg-path.patch messages: 663 nosy: ohanar priority: feature status: unread title: [PATCH] Make 'develop --egg-path' respect specified path in easy_install.pth Added file: http://bugs.python.org/setuptools/file82/respect-egg-path.patch _______________________________________________ Setuptools tracker <setuptools(a)bugs.python.org> <http://bugs.python.org/setuptools/issue140> _______________________________________________

1 0

Proposal: drop md5 for sha256
by Daniel Holth 03 Jul '12

03 Jul '12

I would like to amend the spec. The hash column of RECORD should be 'sha256:' + urlsafe_b64encode(hashlib.sha256(data)) instead of the hopelessly obsolete md5. With a secure hash function, you can digitally sign RECORD. It would also make sense to allow RECORD to be omitted from RECORD.

7 19