Mailman 3 February 2014 - Distutils-SIG

wheel building help needed
by Evgeny Sazhin Feb. 7, 2014

Feb. 7, 2014

Hi, So, i'm trying to get around building the wheel using pip wheel and I'm having some troubles with it. I would appreciate if you could clarify some of the questions for me: I have a structure like that: ./ wheel/ __main__.py my/__init__.py cool/__init__.py package/prog.py __init__.py MANIFEST.in setup.py setup.cfg Where setup.cfg has only [wheel] universal=1 Manifest has: include wheel/__main__.py recursive_include wheel *.py I'm issuing "pip wheel ." and it does put a wheel with some generated info in it into the ./wheelhouse, but there are issues: 1. No python files added, neither __main__.py nor prog.py make it to the wheel, so includes are not working 2. Despite the fact that I have universal=1 there is no py2.py3 in the name it says cp33-cp33m Could anybody hint anything? In addition to that I failed to find the rules for manifest and setup.cfg files (acceptable sections, values, syntax) so i would appreciate if anybody could share a link to the stuff. Thanks a lot! Eugene

6 12

Dependency links are being followed without --process-dependency-links specified
by Piotr Dobrogost Feb. 6, 2014

Feb. 6, 2014

Running `pip install --no-deps -e .` with the following setup.py works ---- setup.py ------- from setuptools import setup, find_packages setup( name="x", version='1.0', packages=find_packages(exclude=['ez_setup']), setup_requires=[ "PasteScript>=1.7", ], ) but after adding (dead) link in dependency_links like this ----- setup.py ----- from setuptools import setup, find_packages setup( name="x", version='1.0', packages=find_packages(exclude=['ez_setup']), setup_requires=[ "PasteScript>=1.7", ], dependency_links=[ "http://www.pylonshq.com/download/" ], ) it does no longer work. Please note I do not specify --process-dependency-links option. I get this error: (ve)pdobrogost@host:~/tmp/x$ pip install --no-deps -e . Obtaining file:///home/users/pdobrogost/tmp/x Running setup.py (path:/home/users/pdobrogost/tmp/x/setup.py) egg_info for package from file:///home/users/pdobrogost/tmp/x Traceback (most recent call last): File "<string>", line 17, in <module> File "/home/users/pdobrogost/tmp/x/setup.py", line 13, in <module> "http://www.pylonshq.com/download/" File "/opt/python/2.7.5/lib/python2.7/distutils/core.py", line 112, in setup _setup_distribution = dist = klass(attrs) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/dist.py", line 239, in __init__ self.fetch_build_eggs(attrs.pop('setup_requires')) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/dist.py", line 263, in fetch_build_eggs parse_requirements(requires), installer=self.fetch_build_egg File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/pkg_resources.py", line 564, in resolve dist = best[req.key] = env.best_match(req, self, installer) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/pkg_resources.py", line 802, in best_match return self.obtain(req, installer) # try and download/install File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/pkg_resources.py", line 814, in obtain return installer(requirement) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/dist.py", line 313, in fetch_build_egg return cmd.easy_install(req) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/command/easy_install.py", line 581, in easy_install self.local_index File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 586, in fetch_distribution self.prescan() File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 484, in prescan list(map(self.scan_url, self.to_scan)) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 768, in scan_url self.process_url(url, True) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 305, in process_url f = self.open_url(url, "Download error on %s: %%s -- Some packages may not be found!" % url) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 702, in open_url return open_with_auth(url, self.opener) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 901, in _socket_timeout return func(*args, **kwargs) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 1014, in open_with_auth fp = opener(request) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 404, in open response = self._open(req, data) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 422, in _open '_open', req) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 382, in _call_chain result = func(*args) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 1214, in http_open return self.do_open(httplib.HTTPConnection, req) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 1187, in do_open r = h.getresponse(buffering=True) File "/opt/python/2.7.5/lib/python2.7/httplib.py", line 1045, in getresponse response.begin() File "/opt/python/2.7.5/lib/python2.7/httplib.py", line 409, in begin version, status, reason = self._read_status() File "/opt/python/2.7.5/lib/python2.7/httplib.py", line 365, in _read_status line = self.fp.readline(_MAXLINE + 1) File "/opt/python/2.7.5/lib/python2.7/socket.py", line 476, in readline data = self._sock.recv(self._rbufsize) socket.timeout: timed out Complete output from command python setup.py egg_info: Traceback (most recent call last): File "<string>", line 17, in <module> File "/home/users/pdobrogost/tmp/x/setup.py", line 13, in <module> "http://www.pylonshq.com/download/" File "/opt/python/2.7.5/lib/python2.7/distutils/core.py", line 112, in setup _setup_distribution = dist = klass(attrs) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/dist.py", line 239, in __init__ self.fetch_build_eggs(attrs.pop('setup_requires')) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/dist.py", line 263, in fetch_build_eggs parse_requirements(requires), installer=self.fetch_build_egg File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/pkg_resources.py", line 564, in resolve dist = best[req.key] = env.best_match(req, self, installer) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/pkg_resources.py", line 802, in best_match return self.obtain(req, installer) # try and download/install File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/pkg_resources.py", line 814, in obtain return installer(requirement) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/dist.py", line 313, in fetch_build_egg return cmd.easy_install(req) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/command/easy_install.py", line 581, in easy_install self.local_index File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 586, in fetch_distribution self.prescan() File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 484, in prescan list(map(self.scan_url, self.to_scan)) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 768, in scan_url self.process_url(url, True) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 305, in process_url f = self.open_url(url, "Download error on %s: %%s -- Some packages may not be found!" % url) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 702, in open_url return open_with_auth(url, self.opener) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 901, in _socket_timeout return func(*args, **kwargs) File "/home/users/pdobrogost/tmp/ve/lib/python2.7/site-packages/setuptools/package_index.py", line 1014, in open_with_auth fp = opener(request) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 404, in open response = self._open(req, data) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 422, in _open '_open', req) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 382, in _call_chain result = func(*args) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 1214, in http_open return self.do_open(httplib.HTTPConnection, req) File "/opt/python/2.7.5/lib/python2.7/urllib2.py", line 1187, in do_open r = h.getresponse(buffering=True) File "/opt/python/2.7.5/lib/python2.7/httplib.py", line 1045, in getresponse response.begin() File "/opt/python/2.7.5/lib/python2.7/httplib.py", line 409, in begin version, status, reason = self._read_status() File "/opt/python/2.7.5/lib/python2.7/httplib.py", line 365, in _read_status line = self.fp.readline(_MAXLINE + 1) File "/opt/python/2.7.5/lib/python2.7/socket.py", line 476, in readline data = self._sock.recv(self._rbufsize) socket.timeout: timed out ---------------------------------------- Cleaning up... Command python setup.py egg_info failed with error code 1 in /home/users/pdobrogost/tmp/x Storing debug log for failure in /home/users/pdobrogost/.pip/pip.log (ve)pdobrogost@host:~/tmp/x$

1 0

PEP 427
by Evgeny Sazhin Feb. 5, 2014

Feb. 5, 2014

Hi, I saw that people from this list are responsible for Wheel related PEP. I’m comparatively new to the python packaging and need some help understanding the recommended way of dealing with python packages. I’m trying to create a development infrastructure that would allow for simple and unified ways of sharing, *deploying* and *reusing* the code within private entity. I can see that pip with virtual environments and requirements.txt is very similar to dependency management provided by maven or apache ivy. But there seems to be a disconnect between the egg carrying the possibility to be importable and executable, but in the same time considered to be deprecated format which is not fully supported by pip and virtualenv and wheel not having those basic questions answered... So, i would like to ask few questions about it : 1. I’m coming from java world, so it is bit hard to understand why new packaging format is not importable? What is the reason behind it? Wouldn’t it be way easier to deal with the dependencies and imports? 2. Why unzipping and installing the wheel is the way to go? There is no need to unzip java jar to import it into your code, neither to run your code with it? Why wheel can’t be used the same exact way? I would appreciate any insight about the development infrastructure the wheel designers have in mind. Thanks in advance, Eugene

7 23

Package different sets of files with sdist and bdist
by Aryeh Leib Taurog Feb. 4, 2014

Feb. 4, 2014

I'm working on a django app, which I'd like to be able to package with setuptools. I use sass/compass, coffeescript, and hamlpy, among other tools to generate supporting static content for my app. I think my build/deploy process should look like this: 1. On my development machine: [dev] $ python setup.py sdist This would create a tarball of all my sources, mainly *.py, *.iced, *.haml, *.sass, and one *.pyx 2. On a build machine: [build] $ compass compile mypkg/static # compile sass to css [build] $ coffee --compile -o mypkg/js mypkg/coffee # compile coffee [build] $ python setup.py bdist_wheel This would create a binary wheel with my c-extension and all my static content compiled. 3. Deploy: [www] $ pip install mypkg-1.0-cp27-none-linux_x86_64.whl The problem is that there doesn't seem to be any easy way to include only the *.coffee and *.sass files in the sdist and only the *.js and *.css files in the bdist, short of deleting the files I want to exclude at each stage prior to running setup.py, which I'd rather not do. I'm using setuptools with VCS support and include_package_data=True. Is there any way to do this, or a more pythonic workflow to accomplish the same goal? Thanks, Aryeh Leib Taurog

1 0

PEX at Twitter (re: PEX - Twitter's multi-platform executable archive format for Python)
by Brian Wickman Feb. 4, 2014

Feb. 4, 2014

This is in response to Vinay's thread but since I wasn't subscribed to distutils-sig, I couldn't easily respond directly to it. Vinay's right, the technology here isn't revolutionary but what's notable is that we've been using it in production for almost 3 years at Twitter. It's also been open-sourced for a couple years at https://github.com/twitter/commons/tree/master/src/python/twitter/common/py… not widely announced (it is, after all, just a small subdirectory in a fairly large mono-repo, and was only recently published independently to PyPI as twitter.common.python.) PEX files are just executable zip files with hashbangs containing a carefully constructed __main__.py and a PEX-INFO, which is json-encoded dictionary describing how to scrub and bootstrap sys.path and the like. They work equally well unpacked into a standalone directory. In practice PEX files are simultaneously our replacement for virtualenv and also our way of distributing Python applications to production. Now we could use virtualenv to do this but it's hard to argue with a deployment process that is literally "cp". Furthermore, most of our machines don't have compiler toolchains or external network access, so hermetically sealing all dependencies once at build time (possibly for multiple platforms since all developers use Macs) has huge appeal. This is even more important at Twitter where it's common to run a dozen different Python applications on the same box at the same time, some using 2.6, some 2.7, some PyPy, but all with varying versions of underlying dependencies. Speaking to recent distutils-sig threads, we used to go way out of our way to never hit disk (going so far as building our own .egg packager and pure python recursive zipimport implementation so that we could import from eggs within zips, write ephemeral .so's to dlopen and unlink) but we've since moved away from that position for simplicity's sake. For practical reasons we've always needed "not zip-safe" PEX files where all code is written to disk prior to execution (ex: legacy Django applications that have __file__-relative business logic) so we decided to just throw away the magical zipimport stuff and embrace using disk as a pure cache. This seems more compatible philosophically with the direction wheels are going for example. Since there's been more movement in the PEP space recently, we've been evolving PEX in order to be as standards-compliant as possible, which is why I've been more visible recently re: talks, .whl support and the like. I'd also love to chat about more about PEX and how it relates to things like PEP 441 and/or other attempts like pyzzer. cheers, brian twitter.com/wickman

11 71

Re: [Distutils] PEP-459 feedback from openSUSE packaging
by Sascha Peilicke Feb. 4, 2014

Feb. 4, 2014

On Wednesday 05 February 2014 00:02:08 Nick Coghlan wrote: > On 4 February 2014 21:43, Sascha Peilicke <saschpe(a)gmx.de> wrote: > > Hi guys, > > > > a colleague of mine hinted me to Nick's plea for feedback on various PEPs > > from other distros perspectives. > > Thanks! Happy to see my linux.conf.au presentation bearing fruit > > > I will provide some general remarks first and latter comment at least > > PEP-459. So for openSUSE (and SLES), we automate Python package > > generation as much as possible. For that we parse the metadata as found > > on PyPI and maul the source distribution (yeah, the tarball) for every > > usable bit. The latter is necessary to properly install files such as > > README, AUTHORS, LICENSE(.txt,...). We also use it to grep for '*test*' > > files to decide if it'S worth generating a RPM %check section. > > > > Some modules do add 'package_data'. That's usually helpful since it goes > > straight into %python_sitelib. For the files mentioned above, we have > > 'data_files'. Not only is it seldomly used, it's almost universally done > > wrong. Simply because every distro differs on where to put these files to. > > PEP 426/459 will hopefully help with some of these, but I suspect only > up to a point - pypi.python.org is always going to maintain a lower > barrier to entry than the Linux distros that try to hammer their > packages into a more integrated whole. I agree and there's much value in keeping that barrier as low as possible. Most of the times, setting "--install-data" to something meaningful (while issueing setup.py install) is sufficient. > > > A different cause of woe are install_requires / requires vs. > > setup_requires > > vs. test_require. Some people use 'requires', which is mostly > > documentation > > and lots of people put _everything_ in install_requires. From a > > distribution> > > viewpoint, you have different sets of requirements: > > - build-time > > > > + optionally doc-requires > > + optionally test-requires > > > > - run-time > > > > So setup_requires / test_require can be used to generate semi-accurate > > BuildRequires: $bla RPM spec tags. But as said, few people use them and > > less do it correct. Maybe because 'setup_requires' doesn't specificy > > build-time reqs but 'setuptools-invocation-time' reqs (which is sth. > > different). Also, we simply use 'install_requires' as both 'Requires:' > > (runtime) and > > 'BuildRequires:' (build-time). But that's a cludge. For example, projects > > include 'Sphinx' in install_requires. What they meant is "if you want to > > build docs, use Sphinx". What they specified is "you always need it". > > Thankfully, the advent of pep allows us to check requirements.txt and > > test- > > requirements.txt. The latter are usually build-time (for the RPM %check > > section). I guess I have to dig into the other PEPs first to see if this > > really changed before being able to comment on that any further. > > Yes, this aspect of the current system is a bit of a mess. One of the > things we're aiming for with the wheel format is to clarify that even > in the existing metadata, "install_requires" should refer to things > needed to create a wheel, while "requires" should refer to things > needed to actuall run the software after unpacking the wheel. > > The proposed PEP 426 dependency tags are probably best summarised in > this section: > http://www.python.org/dev/peps/pep-0426/#mapping-dependencies-to-development > -and-distribution-activities I meanwhile read that and it looks promising so far. I have a bit of a fear that people may be overwhelmed by the options they have. > > Where a documentation dependency like Sphinx ends up would depend on > the project. If the project has no bundled documentation (e.g. online > docs only), then Sphinx would just be a "dev_requires" dependency. > However, if it *did* ship with generated documentation that needed to > be installed on the target system (e.g. man pages), then Sphinx would > instead be a "build_requires" dependency. > > I expect many upstream projects will still need help from the distros > to get this right, but the ultimate aim for metadata 2.0 is to make it > easier for distro repackagers to submit such patches upstream and *get > them accepted as non-controversial changes*. The good thing is that you can send pull requests to them with "do it that way" in the future rather than having to 'sed' around in setup.py files for the next 10 years. > > > In general, the other metadata is good enough (except 'license', see > > below), 'name', 'version', 'upstream_url' and 'description' are used for > > their respective RPM spec counterparts. 'long_description' is used for > > '%description $PKG_NAME'. The tarball download URL is used as 'Source0:'. > > All other metadata tags are ignored because we don't need them to build a > > RPM. > > From a name and version point of view, I'm not at all familiar with > the openSUSE policies, so I'd be interested in knowing if the > restrictions in http://www.python.org/dev/peps/pep-0426/#name would > also meet openSUSE naming guidelines. That certainly help. The openSUSE naming policy is: python-$PYPI_UPSTREAM_NAME or python3-$PYPI_UPSTREAM_NAME so we have packages like "python-zope.interface" or "python-Shed_Skin". I don't remember a module which had special characters (that RPM might frown upon) which we had to replace. > > The version numbering PEP (http://www.python.org/dev/peps/pep-0440/) > is annoyingly complicated, but it unfortunately needs to be in order > to tolerate the diversity of versioning schems already in use on PyPI Versioning is an arcane art. Of course we love semantic versioning (especially because RPM builds a lot of logic around), but if we discover sth crazy, we use this: Version: 0.0.0+$WHATEVERNONSENSE If $WHATEVERNONSE doesn't even increase alphabetically (needed for rpm -U to actually work), we put a date timestamp in front, sth. like: Version 0.0.0+20140201.$WHATEVERNONSENSE or just Version 20140201.$WHATEVERNONSENSE As long as the upstream version increases meaningfully, we're already content > > The 'license' metadata tag is causing the most issues for us. A perceived > > 50% just put "GPL" in there. Which GPL version? GPL-only or actually > > LGPL?. We have a legal crawler that tries to match the version from the > > source code but often it's becomes a manual task or needs a check with > > upstream. This tag is probably the least interesting for an upstream > > developer but the most important one for any distro that has a corporate > > legal entity somewhere in behind (I should say, sue-able entitity :-). So > > with regards to PEP-459 specifically, I have specific recommendations for > > the license tag. Instead of> > > "This field SHOULD contain fewer than 512 characters and MUST > > contain > > > > fewer > > > > than 2048. > > > > This field SHOULD NOT contain any line breaks." > > > > I would propose: > > "This filed SHOULD contain a standardized license identifier as > > > > published by spdx.org." > > > > SPDX-sytle license identifiers are short (less than 20 chars) and can be > > parsed automatically. They are meant to be unambiguous and cross-distro. > > SPDX.org license tags are used extensively inside openSUSE and SLES and > > (to my knowledge) for Fedora and Debian too. That would be the single > > most interesting change I'd be interest in. > > Oh, I hadn't seen SPDX before - very interesting. I'm wondering if it > may be a better fit for the PyPI Trove classifiers though - then it > wouldn't even need to wait for metadata 2.0, we could just add them to > the list of supported classifiers > (https://pypi.python.org/pypi?%3Aaction=list_classifiers) and projects > could start listing them in their current metadata. > > Something like: > > License :: SPDX :: <tag> That is actually a brilliant idea to add it to trove classifiers. Thing is, sdpx provides both a long version and a short identifier. Since I consider trove classifiers to be human-readable, I'm thinking of using the long version for trove and the short one as a recommendation for the License: tag. There's a rationale behind. Some projects really have complex licensing issues (regardless what they claim). Just to give an example, the license for python- psycopg2 we have is: License: LGPL-3.0-with-openssl-exception and (LGPL-3.0-with-openssl-exception or ZPL-2.0) BTW. this is not what upstream thinks they have, this is what our license crawler found out (and what was approved by our legal guys). part of spdx are the boolean operators you see to specify _either_ license X _or_ license Y _and_ licence Z. Happens more often than you can imagine. Therefore, the short spdx identifiers are much more consise rather than using trove classifiers. Currently, you simply can't express 'and' / 'or' with trove classifiers. -- Mit freundlichen Grüßen, Sascha Peilicke

1 0

Fwd: Re: PEP-459 feedback from openSUSE packaging
by Sascha Peilicke Feb. 4, 2014

Feb. 4, 2014

Mhm, I got: "distutils-sig(a)python.org": SMTP error from remote server after RCPT command: host: mail.python.org 4.3.2 Service currently unavailable trying again with corporate mail... -- With kind regards, Sascha Peilicke SUSE Linux GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer HRB 16746 (AG Nürnberg)

1 0

Fwd: Re: PEP-459 feedback from openSUSE packaging
by Sascha Peilicke Feb. 4, 2014

Feb. 4, 2014

Err, forgot reply-all. -- Mit freundlichen Grüßen, Sascha Peilicke

1 0

PEP-459 feedback from openSUSE packaging
by Sascha Peilicke Feb. 4, 2014

Feb. 4, 2014

Hi guys, a colleague of mine hinted me to Nick's plea for feedback on various PEPs from other distros perspectives. I will provide some general remarks first and latter comment at least PEP-459. So for openSUSE (and SLES), we automate Python package generation as much as possible. For that we parse the metadata as found on PyPI and maul the source distribution (yeah, the tarball) for every usable bit. The latter is necessary to properly install files such as README, AUTHORS, LICENSE(.txt,...). We also use it to grep for '*test*' files to decide if it'S worth generating a RPM %check section. Some modules do add 'package_data'. That's usually helpful since it goes straight into %python_sitelib. For the files mentioned above, we have 'data_files'. Not only is it seldomly used, it's almost universally done wrong. Simply because every distro differs on where to put these files to. A different cause of woe are install_requires / requires vs. setup_requires vs. test_require. Some people use 'requires', which is mostly documentation and lots of people put _everything_ in install_requires. From a distribution viewpoint, you have different sets of requirements: - build-time + optionally doc-requires + optionally test-requires - run-time So setup_requires / test_require can be used to generate semi-accurate BuildRequires: $bla RPM spec tags. But as said, few people use them and less do it correct. Maybe because 'setup_requires' doesn't specificy build-time reqs but 'setuptools-invocation-time' reqs (which is sth. different). Also, we simply use 'install_requires' as both 'Requires:' (runtime) and 'BuildRequires:' (build-time). But that's a cludge. For example, projects include 'Sphinx' in install_requires. What they meant is "if you want to build docs, use Sphinx". What they specified is "you always need it". Thankfully, the advent of pep allows us to check requirements.txt and test- requirements.txt. The latter are usually build-time (for the RPM %check section). I guess I have to dig into the other PEPs first to see if this really changed before being able to comment on that any further. In general, the other metadata is good enough (except 'license', see below), 'name', 'version', 'upstream_url' and 'description' are used for their respective RPM spec counterparts. 'long_description' is used for '%description $PKG_NAME'. The tarball download URL is used as 'Source0:'. All other metadata tags are ignored because we don't need them to build a RPM. The 'license' metadata tag is causing the most issues for us. A perceived 50% just put "GPL" in there. Which GPL version? GPL-only or actually LGPL?. We have a legal crawler that tries to match the version from the source code but often it's becomes a manual task or needs a check with upstream. This tag is probably the least interesting for an upstream developer but the most important one for any distro that has a corporate legal entity somewhere in behind (I should say, sue-able entitity :-). So with regards to PEP-459 specifically, I have specific recommendations for the license tag. Instead of "This field SHOULD contain fewer than 512 characters and MUST contain fewer than 2048. This field SHOULD NOT contain any line breaks." I would propose: "This filed SHOULD contain a standardized license identifier as published by spdx.org." SPDX-sytle license identifiers are short (less than 20 chars) and can be parsed automatically. They are meant to be unambiguous and cross-distro. SPDX.org license tags are used extensively inside openSUSE and SLES and (to my knowledge) for Fedora and Debian too. That would be the single most interesting change I'd be interest in. I hope this was helpful, feel free to bug me if you need further detail. -- Mit freundlichen Grüßen, Sascha Peilicke

4 6

distlib.mount API design (was: wheels on sys.path clarification (reboot))
by Nick Coghlan Feb. 1, 2014

Feb. 1, 2014

On 30 January 2014 21:57, Vinay Sajip <vinay_sajip(a)yahoo.co.uk> wrote: >> My one technical issue is with going beyond zipimport >> behaviour to the point of extracting DLLs to the filesystem. >> I remain -1 on that feature, and I believe I have explained why I think >> there are issues (and why I think that any solution should be part of >> zipimport and not added on in library or user code). But I'm happy to go >> through the details again, if you like - or just to accept that I don't > > Yes please, let's get into some details. Of course I understand that you > might not want to use the feature, but I don't understand the -1 on the feature > per se - whether it is in distlib or in zipimport is a secondary consideration. I > agree that zipimport is the logical place for it, but ISTM the reason why it can't > go in there just yet is also the reason why one might have some reservations > about the feature: binary compatibility. I accept that this not yet a fully resolved > issue in general (cf. the parallel discussion about numpy), but if we can > isolate these issues, we can perhaps tackle them. But for me, that's the main > reason why this part of the distlib API is experimental. I actually think this is a useful thing to experiment with, I'm just not sure distlib is the best place for that experiment. With appropriately secure tempfile handling and the right sys.path (and module __path__) manipulation it's not obviously *impossible* to handle C extensions at arbitrary positions in the module namespace this way, just difficult. zipimport itself is a bad place to experiment though, since not only is it currently a complex ball of C code, but adding such a feature without clear evidence of robust support in a third party project would be irresponsible. In the case of distlib, the potential complexity of ensuring that such a scheme works consistently across multiple platforms and as part of various complex package layouts is enough to make me nervous about having it in the same library as the metadata 2.0 reference implementation :) Now, if you were to split that functionality out from distlib into a separate "wheeltab" project (or a name of your choice), I'd be substantially less nervous, because endorsing distlib as the metadata 2.0 reference implementation wouldn't carry any implications of endorsing a feature I consider "potentially interesting but rather challenging to implement in a robust manner". mount() would become something I could explore when I had some additional free time (hah!), rather than something I felt obliged to help get to a more robust state before releasing metadata 2.0. Cheers, Nick. -- Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia

4 8