Mailman 3 June 2015 - Distutils-SIG

ImportError running 'test' on namespace package - other package in namespace not found
by Jason R. Coombs 17 Apr '20

17 Apr '20

I've got two projects: mynamespace.myprojectA and mynamespace.myprojectB myprojectB depends on myprojectA. I'm using setuptools 0.6c8 to manage both projects. Both projects are registered using 'setup develop'. Both projects are accessible from an interactive interpreter: PS C:\Users\me\projects> python Python 2.5.2 (r252:60911, Feb 21 2008, 13:11:45) [MSC v.1310 32 bit (Intel)] on win32 Type "help", "copyright", "credits" or "license" for more information. >>> import mynamespace.myprojectA >>> import mynamespace.myprojectB >>> from mynamespace.myprojectA import mymoduleZ However, when I run 'setup test' in myprojectB, the tests fail with File ".mymoduleZ.py", line NNN, in [some context] from mynamespace.myprojectA.mymoduleZ import MyClassC ImportError: No module named myprojectA.mymoduleZ In setup.py, the test_suite is nose.collector. I searched and couldn't find anyone else with this problem. Is this a supported configuration? Is there something I can do to make tests work with interdependent projects with the same root namespace? If there's not something obvious I should be doing differently, I'm happy to put together a minimal test case that reproduces the problem. Any suggestions are appreciated. Sincerely, Jason R. Coombs

3 6

Surviving a Compromise of PyPI - PEP 458 and 480
by Vladimir Diaz 12 Feb '20

12 Feb '20

Hello everyone, I am a research programmer at the NYU School of Engineering. My colleagues (Trishank Kuppusamy and Justin Cappos) and I are requesting community feedback on our proposal, "Surviving a Compromise of PyPI." The two-stage proposal can be reviewed online at: PEP 458 http://legacy.python.org/dev/peps/pep-0458/ PEP 480 http://legacy.python.org/dev/peps/pep-0480/ Summary of the Proposal: "Surviving a Compromise of PyPI" proposes how the Python Package Index (PyPI) can be amended to better protect end users from altered or malicious packages, and to minimize the extent of PyPI compromises against affected users. The proposed integration allows package managers such as pip to be more secure against various types of security attacks on PyPI and defend end users from attackers responding to package requests. Specifically, these PEPs describe how PyPI processes should be adapted to generate and incorporate repository metadata, which are signed text files that describe the packages and metadata available on PyPI. Package managers request (along with the packages) the metadata on PyPI to verify the authenticity of packages before they are installed. The changes to PyPI and tools will be minimal by leveraging a library, The Update Framework <https://github.com/theupdateframework/tuf>, that generates and transparently validates the relevant metadata. The first stage of the proposal (PEP 458 <http://legacy.python.org/dev/peps/pep-0458/>) uses a basic security model that supports verification of PyPI packages signed with cryptographic keys stored on PyPI, requires no action from developers and end users, and protects against malicious CDNs and public mirrors. To support continuous delivery of uploaded packages, PyPI administrators sign for uploaded packages with an online key stored on PyPI infrastructure. This level of security prevents packages from being accidentally or deliberately tampered with by a mirror or a CDN because the mirror or CDN will not have any of the keys required to sign for projects. The second stage of the proposal (PEP 480 <http://legacy.python.org/dev/peps/pep-0480/>) is an extension to the basic security model (discussed in PEP 458) that supports end-to-end verification of signed packages. End-to-end signing allows both PyPI and developers to sign for the packages that are downloaded by end users. If the PyPI infrastructure were to be compromised, attackers would be unable to serve malicious versions of these packages without access to the project's developer key. As in PEP 458, no additional action is required by end users. However, PyPI administrators will need to periodically (perhaps every few months) sign metadata with an offline key. PEP 480 also proposes an easy-to-use key management solution for developers, how to interface with a potential build farm on PyPI infrastructure, and discusses the security benefits of end-to-end signing. The second stage of the proposal simultaneously supports real-time project registration and developer signatures, and when configured to maximize security on PyPI, less than 1% of end users will be at risk even if an attacker controls PyPI and goes undetected for a month. We thank Nick Coghlan and Donald Stufft for their valuable contributions, and Giovanni Bajo and Anatoly Techtonik for their feedback. Thanks, PEP 458 & 480 authors.

7 53

Upgrading dependencies
by Charlie Moad 29 Apr '18

29 Apr '18

Is it currently possible to upgrade dependencies as well when upgrading a packages? If not, this would be a really nice feature to add to easy_install. Maybe a call like: easy_install --upgrade --upgrade-deps Package Obviously it makes sense to leave this off by default. Thanks, Charlie

2 1

Changes to --find-links and --upgrade in SVN
by Phillip J. Eby 29 Apr '18

29 Apr '18

Elvelind Grandin reported a problem with the "develop" command that turned out to be a flaw in its --find-links support. Specifically, it wasn't ever processing the links. :) In the process of fixing it, I wound up cleaning up an annoying (to me, at least) quirk of the previous workings of --find-links. It used to be that find-links would always be processed first, no matter what, even if you were doing a completely local operation. This would've been especially annoying if it carried over into "develop", so I made some changes. Now, if an item passed to --find-links is local (a filename or file: URL), or a direct link to an egg or other distribution, it is indexed immediately. Remote URLs are now only retrieved if a dependency can't be resolved locally, or if you use the -U or --upgrade options (this goes for "develop" too). Note that this is a behavior change for easy_install, which was effectively treating --find-links as though you'd specified --upgrade in certain cases. So, if you're used to getting upgrades downloaded as a result of using --find-links, please note that this will no longer happen. EasyInstall will now *only* go online if a dependency can't be resolved locally, if -U or --upgrade is used, or if you provided suitable direct URLs via an argument or --find-links, or via a link in a local .html file.

2 1

Problems with svn in windows
by Sharky On PTNet 29 Apr '18

29 Apr '18

Hi, I´m trying to do "easy_install setuptools==dev" in a windows box but have an error with svn command. """... 'svn' is not recognized as an internal or external command, ...""" I have installed TortoiseSVN but it seems that don't have command line, is all with the Explorer. Can you tell me what client I may use in windows? Thanks for all, Helio Pereira Sharky @ PTNet

3 2

local development scenarios
by tgreenwood 29 Apr '18

29 Apr '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm new to distutils/and the egg system. I have not researched the archives as much as I should, so please excuse me if this is familiar territory... Q: Is it possible for dependency checks to work for non pipy deployed eggs? - A.egg - B.egg (setup_requires and install_requires A.egg) - email A and B eggs to friend - tell friend to : easy_install B - but B.egg does not install A...in fact, in my test case, it fails b/c it cannot find A in pipy - in this example, what happens if friend does not have net connection on target machine? how can they install from the eggs alone and get the dep checking to work? Q: How does my friend run the unittests on the egg that they have just installed? As I am developing, I frequently run the unittests and after every bdist_egg build, I also run the unit tests that way, too. How can the consumer do the same? Q: One of my apps is a command line app, say foo.py is a command line app that takes arg1, arg2,... How can the user run this app when it is encased in an egg? Q: How do I define my own pipy? While I like the idea of deploying there for the overall community, I don't want to send my half baked code into the wild. But I'd like to try the general functionality of having a deploy site for my beta customers. How can I set this up? Thanks in advance. - -Todd -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDl9Hfz6uXX4lQc/URAnY4AJ47DFHL/cpEltmqoUyGqzhsK5FjRACgt01v akc3Wh3IOXVv2jiS8TszhuE= =Rv/x -----END PGP SIGNATURE-----

5 12

Choice of dependencies?
by John J Lee 29 Apr '18

29 Apr '18

Is it possible for a package to depend on one of several packages, with the user having the option to pick? For example, my package P might depend on package A, plus either package B or package C. I know I could (ab)use extras_require, but in my case this is a real dependency rather than an optional extra. The other option I have is to just pick one of the dependencies (B or C in my example above), and thereby force people to install it even though it's not strictly required. Neither option seems particularly attractive. John

3 6

setuptools doc patch
by John J Lee 29 Apr '18

29 Apr '18

The comma removed by the patch below implies that users working from a Subversion checkout should not use EasyInstall to periodically fetch the latest version. That's not what you intended to say, I assume? http://peak.telecommunity.com/DevCenter/setuptools You should also inform your users of the need to run this command, if they -are working from a Subversion checkout, rather than using EasyInstall to +are working from a Subversion checkout rather than using EasyInstall to periodically fetch the latest version. Hmm, probably much better than the patch above: -You should also inform your users of the need to run this command, if they -are working from a Subversion checkout, rather than using EasyInstall to -periodically fetch the latest version. +If your users are working from a Subversion checkout rather than using +EasyInstall, you should also inform them of the need to run this command +to periodically fetch the latest version. John

2 2

Re: [Distutils] distutils install probs on suse 9.0
by Mats Wichmann 29 Apr '18

29 Apr '18

At 05:43 AM 5/18/2004, David Handy wrote: >On Tue, 18 May 2004, Floris van der Tak wrote: > >> my attempt to install the distutils on suse 9.0 (which provides python >> 2.3) fails: > >Why are you installing distutils on a system that already has Python 2.3 >installed? Python 2.3 normally comes with distutils as part of the Python >standard library. > >Did suse distribute a version of Python that had distutils removed? It should come from python-devel

2 1

Sample setup.py for Numeric Python
by Greg Ward 29 Apr '18

29 Apr '18

Hi again -- [cc'd to Paul Dubois: you said you weren't following the distutils sig anymore, but this directly concerns NumPy and I'd like to get your input!] here's that sample setup.py for NumPy. See below for discussion (and questions!). ------------------------------------------------------------------------ #!/usr/bin/env python # Setup script example for building the Numeric extension to Python. # This does sucessfully compile all the .dlls. Nothing happens # with the .py files currently. # Move this file to the Numerical directory of the LLNL numpy # distribution and run as: # python numpysetup.py --verbose build_ext # # created 1999/08 Perry Stoll __rcsid__ = "$Id: numpysetup.py,v 1.1 1999/09/12 20:42:48 gward Exp $" from distutils.core import setup setup (name = "numerical", version = "0.01", description = "Numerical Extension to Python", url = "http://www.python.org/sigs/matrix-sig/", ext_modules = [ ( '_numpy', { 'sources' : [ 'Src/_numpymodule.c', 'Src/arrayobject.c', 'Src/ufuncobject.c' ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/numpy.def' } ), ( 'multiarray', { 'sources' : ['Src/multiarraymodule.c'], 'include_dirs' : ['./Include'], 'def_file': 'Src/multiarray.def' } ), ( 'umath', { 'sources': ['Src/umathmodule.c'], 'include_dirs' : ['./Include'], 'def_file' : 'Src/umath.def' } ), ( 'fftpack', { 'sources': ['Src/fftpackmodule.c', 'Src/fftpack.c'], 'include_dirs' : ['./Include'], 'def_file' : 'Src/fftpack.def' } ), ( 'lapack_lite', { 'sources' : [ 'Src/lapack_litemodule.c', 'Src/dlapack_lite.c', 'Src/zlapack_lite.c', 'Src/blas_lite.c', 'Src/f2c_lite.c' ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/lapack_lite.def' } ), ( 'ranlib', { 'sources': ['Src/ranlibmodule.c', 'Src/ranlib.c', 'Src/com.c', 'Src/linpack.c', ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/ranlib.def' } ), ] ) ------------------------------------------------------------------------ First, what d'you think? Too clunky and verbose? Too much information for each extension? I kind of think so, but I'm not sure how to reduce it elegantly. Right now, the internal data structures needed to compile a module are pretty obviously exposed: is this a good thing? Or should there be some more compact form for setup.py that will be expanded later into the full glory we see above? I've already made one small step towards reducing the amount of cruft by factoring 'include_dirs' out and supplying it directly as a parameter to 'setup()'. (But that needs code not in the CVS archive yet, so I've left the sample setup.py the same for now.) The next thing I'd like to do is get that damn "def_file" out of there. To support it in MSVCCompiler, there's already an ugly hack that unnecessarily affects both the UnixCCompiler and CCompiler classes, and I want to get rid of that. (I refer to passing the 'build_info' dictionary into the compiler classes, if you're familiar with the code -- that dictionary is part of the Distutils extension-building system, and should not propagate into the more general compiler classes.) But I don't want to give these weird "def file" things standing on the order of source files, object files, libraries, etc., because they seem to me to be a bizarre artifact of one particular compiler, rather than something present in a wide range of C/C++ compilers. Based on the NumPy model, it seems like there's a not-too-kludgy way to handle this problem. Namely: if building extension "foo": if file "foo.def" found in same directory as "foo.c" add "/def:foo.def" to MSVC command line this will of course require some platform-specific code in the build_ext command class, but I figured that was coming eventually, so why put it off? ;-) To make this hack work with NumPy, one change would be necessary: rename Src/numpy.def to Src/_numpy.def to match Src/_numpy.c, which implements the _numpy module. Would this be too much to ask of NumPy? (Paul?) What about other module distributions that support MSVC++ and thus ship with "def" files? Could they be made to accomodate this scheme? Thanks for your feedback -- Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

4 5

Can now compile simple extensions
by Greg Ward 29 Apr '18

29 Apr '18

Hi all -- at long last, I found the time to hack in the ability to compile extension modules to the Distutils. Mainly, this meant adding a 'build_ext' command which uses a CCompiler instance for all its dirty work. I also had to add a few methods to CCompiler (and, of course, UnixCCompiler) to make this work. And I added a new module, 'spawn', which takes care of running sub-programs more efficiently and robustly (no shell involved) than os.system. That's needed, obviously, so we can run the compiler! If you're in the mood for grubbing over raw source code, then get the latest from CVS or download a current snapshot. See http://www.python.org/sigs/distutils-sig/implementation.html for a link to the code snapshot. I'm still waiting for more subclasses of CCompiler to appear. At the very least, we're going to need MSVCCompiler to build extensions on Windows. Any takers? Also, someone who knows the Mac, and how to run compilers programmatically there, will have to figure out how to write a Mac-specific concrete CCompiler subclass. The spawn module also needs a bit of work to be portable. I suspect that _win32_spawn() (the intended analog to my _posix_spawn()) will be easy to implement, if it even needs to go in a separate function at all. It looks from the Python Library documentation for 1.5.2 that the os.spawnv() function is all we need, but it's a bit hard to figure out just what's needed. Windows wizards, please take a look at the 'spawn()' function and see if you can make it work on Windows. As for actually compiling extensions: well, if you can figure out the build_ext command, go ahead and give it a whirl. It's a bit cryptic right now, since there's no documentation and no example setup.py. (I have a working example at home, but it's not available online.) If you feel up to it, though, see if you can read the code and figure out what's going on. I'm just hoping *I'll* be able to figure out what's going on when I get back from the O'Reilly conference next week... ;-) Enjoy -- Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

2 1

Two fixes (at last)
by Greg Ward 29 Apr '18

29 Apr '18

Hi all -- at long last, I have fixed two problems that a couple people noticed a while ago: * I folded in Amos Latteier's NT patches almost verbatim -- just changed an `os.path.sep == "/"' to `os.name == "posix"' and added some comments bitching about the inadequacy of the current library installation model (I think this is Python's fault, but for now Distutils is slavishly aping the situation in Python 1.5.x) * I fixed the problem whereby running "setup.py install" without doing anything else caused a crash (because 'build' hadn't yet been run). Now, the 'install' command automatically runs 'build' before doing anything; to make this bearable, I added a 'have_run' dictionary to the Distribution class to keep track of which commands have been run. So now not only are command classes singletons, but their 'run' method can only be invoked once -- both restrictions enforced by Distribution. The code is checked into CVS, or you can download a snapshot at http://www.python.org/sigs/distutils-sig/distutils-19990607.tar.gz Hope someone (Amos?) can try the new version under NT. Any takers for Mac OS? BTW, all parties involved in the Great "Where Do We Install Stuff?" Debate should take a good, hard look at the 'set_final_options()' method of the Install class in distutils/install.py; this is where all the policy decisions about where to install files are made. Currently it apes the Python 1.5 situation as closely as I could figure it out. Obviously, this is subject to change -- I just don't know to *what* it will change! Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

2 1

Package versioning
by Timothy Docker 29 Apr '18

29 Apr '18

Hi all, I've been aware that the distutils sig has been simmerring away, but until recently it has not been directly relevant to what I do. I like the look of the proposed api, but have one question. Will this support an installed system that has multiple versions of the same package installed simultaneously? If not, then this would seem to be a significant limitation, especially when dependencies between packages are considered. Assuming it does, then how will this be achieved? I am presently managing this with a messy arrangement of symlinks. A package is installed with its version number in it's name, and a separate directory is created for an application with links from the unversioned package name to the versioned one. Then I just set the pythonpath to this directory. A sample of what the directory looks like is shown below. I'm sure there is a better solution that this, and I'm not sure that this would work under windows anyway (does windows have symlinks?). So, has this SIG considered such versioning issues yet? Cheers, Tim -------------------------------------------------------------- Tim Docker timd(a)macquarie.com.au Quantative Applications Division Macquarie Bank -------------------------------------------------------------- qad16:qad $ ls -l lib/python/ total 110 drwxr-xr-x 2 mts mts 512 Nov 11 11:23 1.1 -r--r----- 1 root mts 45172 Sep 1 1998 cdrmodule_0_7_1.so drwxr-xr-x 2 mts mts 512 Sep 1 1998 chart_1_1 drwxr-xr-x 3 mts mts 512 Sep 1 1998 Fnorb_0_7_1 dr-xr-x--- 3 mts mts 512 Nov 11 11:21 Fnorb_0_8 drwxr-xr-x 3 mts mts 1536 Mar 3 12:45 mts_1_1 dr-xr-x--- 7 mts mts 512 Nov 11 11:22 OpenGL_1_5_1 dr-xr-x--- 2 mts mts 1024 Nov 11 11:23 PIL_0_3 drwxr-xr-x 3 mts mts 512 Sep 1 1998 Pmw_0_7 dr-xr-x--- 2 mts mts 512 Nov 11 11:21 v3d_1_1 qad16:qad $ ls -l lib/python/1.1 total 30 lrwxrwxrwx 1 root other 29 Apr 10 10:43 _glumodule.so -> ../OpenGL_1_5_1/_glumodule.so lrwxrwxrwx 1 root other 30 Apr 10 10:43 _glutmodule.so -> ../OpenGL_1_5_1/_glutmodule.so lrwxrwxrwx 1 root other 22 Apr 10 10:43 _imaging.so -> ../PIL_0_3/_imaging.so lrwxrwxrwx 1 root other 36 Apr 10 10:43 _opengl_nummodule.so -> ../OpenGL_1_5_1/_opengl_nummodule.so lrwxrwxrwx 1 root other 27 Apr 10 10:43 _tkinter.so -> ../OpenGL_1_5_1/_tkinter.so lrwxrwxrwx 1 mts mts 21 Apr 10 10:43 cdrmodule.so -> ../cdrmodule_0_7_1.so lrwxrwxrwx 1 mts mts 12 Apr 10 10:43 chart -> ../chart_1_1 lrwxrwxrwx 1 root other 12 Apr 10 10:43 Fnorb -> ../Fnorb_0_8 lrwxrwxrwx 1 mts mts 12 Apr 10 10:43 mts -> ../mts_1_1 lrwxrwxrwx 1 root other 15 Apr 10 10:43 OpenGL -> ../OpenGL_1_5_1 lrwxrwxrwx 1 root other 33 Apr 10 10:43 opengltrmodule.so -> ../OpenGL_1_5_1/opengltrmodule.so lrwxrwxrwx 1 root other 33 Apr 10 10:43 openglutil_num.so -> ../OpenGL_1_5_1/openglutil_num.so lrwxrwxrwx 1 root other 10 Apr 10 10:43 PIL -> ../PIL_0_3 lrwxrwxrwx 1 mts mts 10 Apr 10 10:43 Pmw -> ../Pmw_0_7 lrwxrwxrwx 1 root other 10 Apr 10 10:43 v3d -> ../v3d_1_1

3 2

[Distutils-sig] distutils charter and interscript
by John Skaller 29 Apr '18

29 Apr '18

3 2

Versioned trove classifiers for Django
by James Bennett 06 Apr '17

06 Apr '17

Following up on some IRC discussion with other folks: There is precedent (Plone) for PyPI trove classifiers corresponding to particular versions of a framework. So I'd like to get feedback on the idea of expanding that, particularly in the case of Django. The rationale here is that the ecosystem of Django-related packages is quite large, but -- as I know all too well from a project I'm working on literally at this moment -- it can be difficult to ensure that all of one's dependencies are compatible with the version of Django one happens to be using. Adding trove classifier support at the level of individual versions of Django would, I think, greatly simplify this: tools could easily analyze which packages are compatible with an end user's chosen version, there'd be far less manual guesswork, etc., and the rate of creation of new classifiers would be relatively low (we tend to have one X.Y release/year or thereabouts, and that's the level of granularity needed). Assuming there's consensus around the idea of doing this, what would be the correct procedure for getting such classifiers set up and maintained?

5 17

picky 0.8 released!
by Chris Withers 09 Jul '15

09 Jul '15

Hi All, I'm please to announce the first release of picky, a tool for checking versions of packages used pip are as specified in their requirements files. I wrote this tool because it's all too easy to have a requirements.txt file for you project that you think covers all the resources you're using, only to find you've been dragging in extra packages unknowingly, and you now have different versions of those in development and production, causing lots of debugging misery! Using picky is as easy as: $ pip install picky $ echo 'picky==0.8' >> requirements.txt $ picky If you want to update your requirements.txt based on your current environment: $ picky --update Full docs are at http://picky.readthedocs.org/en/latest/. Source control and issue trackers are at https://github.com/Simplistix/picky. <https://github.com/Simplistix/picky> Any problems, please ask here or mail me direct! cheers, Chris

2 1

Accessing package data files in wheels
by Justin Uang 30 Jun '15

30 Jun '15

Hi, What is the recommended way to get access to a data file in my package if I'm using a wheel? pkg_resources seems like it's mainly useful because eggs might be used in a zipped form, but for wheels, I'm guaranteed that the data will be unpacked into a directory structure right? In that case, should I just use __file__ to manually find the location of the file? I'm assuming I can still use pkg_resources, but it feels like I'm adding an unnecessary dependency on setuptools, given that setuptools isn't needed during installation but only when building the wheel. Thanks! Justin

7 10

how to install pip and six module/packages in python 3.4.3
by Daler Ali 29 Jun '15

29 Jun '15

Sent from Windows Mail

1 0

Requesting the removal of an empty / abandoned PyPi package
by Makoto 28 Jun '15

28 Jun '15

Hello, I was told to send an e-mail to this address to request the removal of what appears to be a completely empty and abandoned PyPi package, so that I may make use of the package name. This is the package in question: https://pypi.python.org/pypi/typewriter/0.0.1 This is the project I wish to submit to PyPi, which also uses the name "typewriter", https://github.com/FujiMakoto/python-typewriter (It's really just a single very simple module that adds a simple typewriter animation to print, but I can't think of any other real uses for the package name "typewriter" and even if it is really simple it seems like something that would be useful to others.) My PyPi username is " FujiMakoto" if that is needed.

1 0

Introducing Wheelhouse
by Randy Syring 26 Jun '15

26 Jun '15

Wheelhouse is a utility to help maintain a wheelhouse. The code for this project is rather basic, but it's the concept that counts. Putting the concept of a wheelhouse into practice has made managing dependencies for our projects across dev, testing and production environments much, much easier. Checkout Keg <https://github.com/level12/keg> to see a project which is using a wheelhouse in conjunction with tox to manage dependencies. What is a Wheelhouse? A wheelhouse is a local cache of python packages in wheel format that gets committed with your code to your VCS. When installing packages during continuous integration and production, the wheels in the wheelhouse are used instead of depending on PyPI or some other network location. Advantages: * Wheels are stored in your DVCS bringing further clarity to exactly what packages are needed/expected and how they have changed over time. * CI builds are faster and more consistent. Due to the increased speed of installing wheels from a local cache instead of pulling them from a network location, we can have tox start with a new virtualenv before every run, thereby insuring all dependencies have been specified and installed into the wheelhouse correctly. * Production deployments are similarly fast and consistent. Since the CI and production servers both pull from the same wheelhouse we have higher certainty that our production code is running against the exact same packages that have been tested. * Since wheels are built on development or build machines, the need for development system packages to be installed on production servers is removed. * Targeting forks, development versions, unpublished, and/or private software for production is much easier than setting up & maintaining a private PyPI server like devpi <http://doc.devpi.net/latest/>. * Splits the package management process into two distinct steps: 1. Build packages (from various locations, with specified version) and put wheels in the wheelhouse. 2. Install the latest version of a package from the wheelhouse. Links: https://pypi.python.org/pypi/Wheelhouse https://github.com/level12/wheelhouse *Randy Syring* Husband | Father | Redeemed Sinner /"For what does it profit a man to gain the whole world and forfeit his soul?" (Mark 8:36 ESV)/

2 2

pip freeze not reporting pip or wsgiref
by Chris Withers 22 Jun '15

22 Jun '15

Hi All, A couple of buglets I've noticed while using picky in anger: 1. pip freeze doesn't include a line for pip itself, why is that? 2. pip freeze doesn't include packages provided by the standard libary (ie: wsgiref), even if they're explicitly specified in requirements.txt. What's the pip developers view of both of the above? Is this still the right forum to discuss these things? cheers, Chris

3 3

executable egg & top-level __main__.py
by Dimitri Maziuk 19 Jun '15

19 Jun '15

Hi all, I have the following directory structure: myegg/ pkg1/ __init__.py ... pkg2/ __init__.py ... pkg3/ __init__.py ... setup.py __main__.py If I zip this into myegg.egg and run "python myegg.egg", that runs the top-level __main__.py. If I run "python setup.py bdist_egg" and run the resulting egg, I get "/usr/bin/python: can't find '__main__.py'" in the egg. That is correct: according to "unzip -l" __main__.py is not there. How do I get it included? Or more to the point, how do I make that egg directly executable? -- note that I want it to run a script that isn't in any of the bundled packages (but imports from them). (centos 6 with python 2.6 and python-setuptools-0.6.10 and centos 7 with python 2.7 and python-setuptools-0.9.8) -- Dimitri Maziuk Programmer/sysadmin BioMagResBank, UW-Madison -- http://www.bmrb.wisc.edu

4 13

pip caching docs lie?
by Chris Withers 19 Jun '15

19 Jun '15

Hi All, These two sections: https://pip.pypa.io/en/latest/reference/pip_install.html#caching https://pip.pypa.io/en/latest/reference/pip_install.html#wheel-cache ...imply that downloading packages with pip 7.x+ should create an offline cached egg. Not so: (pip_cache)tweedledee:virtualenvs chris$ pip --version pip 7.0.3 from /Users/chris/virtualenvs/pip_cache/lib/python2.7/site-packages (python 2.7) (pip_cache)tweedledee:virtualenvs chris$ pip install xlwt Collecting xlwt Downloading xlwt-1.0.0-py2.py3-none-any.whl (140kB) 100% |████████████████████████████████| 143kB 730kB/s Installing collected packages: xlwt Successfully installed xlwt-1.0.0 (pip_cache)tweedledee:virtualenvs chris$ ls ~/Library/Caches/pip/ http selfcheck.json (pip_cache)tweedledee:virtualenvs chris$ find ~/Library/Caches/pip/ -name wheels (pip_cache)tweedledee:virtualenvs chris$ Nope, no wheel cache there. What am I missing? Are those docs just plain wrong? cheers, Chris

2 2

easy_install deprecated?
by Thomas Güttler 18 Jun '15

18 Jun '15

Some packages have docs like this: {{{ Installation ========== easy_install foo or pip install foo }}} Maybe I am too new in the python packaging world, but for my eyes calling easy_install looks deprecated. My goal is to make the python world more friendly for newcomers. Are there still reason to use easy_install and not pip? I would like to make the docs more readable and remove the word "or" from them. Things should be straight forward for newcomers and experts know how to help themselves. What do you think? For people loving details: this mail checks if there is a general consensus. It does not matter which packages I refer to. Regards, Thomas Güttler -- Thomas Guettler http://www.thomas-guettler.de/

3 2

local platform tags and pip wheel caching
by Robert Collins 13 Jun '15

13 Jun '15

So the pip wheel caching feature has promoted a few latent problems into the limelight. One is that many wheels projects built are not actually as compatible as thought. https://github.com/pypa/pip/issues/2882 One is that wheels don't support writing datafiles outside their environment. https://github.com/pypa/pip/issues/2874 And the one I want to talk about is that we don't generate sufficiently good platform markers on Linux. https://github.com/pypa/pip/issues/2875 That bug describes the scenario of using a wheel cache shared across multiple Linux ABIs - e.g. LXC containers with a bind mounted home dir, or NFS on a cluster. pip 7's implicit wheel cache triggers this situation for people. The OP has suggested that being able to control the platform tag that pip a) looks for and b) instructs wheel to use would let them avoid issues in this situation without having to solve the general problem of 'the universe of Linuxs can't agree on anything'. e.g, in each context they could set a /etc/pip.conf containing [global] wheel_platform = contextname and then pip would use that and instruct built wheels to use that. Further, they not that it can be used to e.g. describe other local policies like 'I want hardened C builds' that are not inferrable from context at all today. But since this affects pip *and* wheel, we're bringing it here for discussion. I'm in favour of it - it fits the existing wheel spec; its opt-in, non-intrusive and solves a real, present problem. [just not the 'how do we get these damn things into PyPI, yet]. -Rob -- Robert Collins <rbtcollins(a)hp.com> Distinguished Technologist HP Converged Cloud

4 6

Setuptools 18.0b1 available for testing (improved Cython build support).
by Jason R. Coombs 10 Jun '15

10 Jun '15

I’m pleased to announce a fix for improved Cython support per Setuptools #288 (https://bitbucket.org/pypa/setuptools/issue/288). I’ve published a beta release 18.0b1 in the Setuptools project downloads (https://bitbucket.org/pypa/setuptools/downloads/setuptools-18.0b1.zip) for pre-release testing. Release notes are here (https://bitbucket.org/pypa/setuptools/src/4249669040239bff20196b17ccd4d7387…). Please, if you use any projects with Cython modules, give this install a trial run and report any issues in the Setuptools bug tracker. I hope to release 18.0 in the next few weeks if there aren’t any emergent blockers. Thanks! Jason

2 1

The role and functionality of customize_compiler
by Poor Yorick 05 Jun '15

05 Jun '15

It looks like the defaults for ccompiler.executables that are set in compiler-specific sublcasses like UnixCCompiler are always overridden by customize_compiler in sysconfig.py. For example, in UnixCcompiler the value for executables['compiler'] is ["cc"], but this will never be used because comtomize_compiler invariably grabs the compiler value out of the Python Makefile and uses that. Should customize_compiler be reorganized a bit so that defaults are actually used if customize_compiler comes up empty-handed for certain values? Next, it looks like customize_compiler is really a method of UnixCcompiler disguised as an independent function. Would it make sense for Ccompiler to have an abstract method, "customize", and to move the current customize_compiler function into UnixCcompiler? On the topic of include directories, would it make sense to add a "sysinclude_dirs" option to the Extension class in order separate out the two different uses that include_dirs currently plays in setup.py scripts? -- Yorick

1 0

Re: [Distutils] 'virtualenv -p jython' leaves 'pip' non-executable
by Tres Seaver 04 Jun '15

04 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/04/2015 03:43 AM, Suresh V. wrote: > Could it be your umask? Just wondering... > Nope. This issue only affects the 'jython' environment -- all other tox environments run fine. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJVcECOAAoJEPKpaDSJE9HY73cP/ip5pY1NxhdOo0jAHACQxGGN U4bhzcNm0Qy+WGHQfCfNnIVAVMNgAdFV1nfI1Uu6x4I4lS6Ljm5Q1lXn4k4SqHcg ttGs1nDDuZYEYFooKKxOsLOWISwR7FTQct9tOUAZa+uu/a1uN8RyjwbB2/c6XOJU HR0FYfIAn37yZ3I6pITFrC5cUJ3E2ddDZBjim7jHvWGgQaSb+5fjor1BRKzrVj46 L6nxLPLsaQeepJtWGvDr9OzIr4zfovhtSdLXOr7uCNrORk49VGQYETjk4hDenB2I c/OFEFt+XTL5Rf95fTQNj7v04rd80witBTSN5xNEyIqYaduFinbql2gEmTkooqpc cJCkBHpphHY5UJj9fnQPqVKQjRL0kaopWXg+4DGEqPu5Rj+V21Cn9BHad8flo4No jjcwSFjRTqJdfc4uzQ20UMZFOkX01Ak/REO77MfxcywE8nqrRFqC8j8IS6gGKWAN +k7/UjgoOzC0qzmjnYBGBXZH/UgQMPFEcIQ2HJ/o1G7vL9y6MocC2Hjc558YLfT6 +IiDmOrIErxV8oMWkarCoTFdW7aILim8AbCQ/XfUezVE3dNkbXuXf/VoUWrOutni CMwpDTcwdZCvdqnwuE2/nEZcCQUTxyaVUorSERjsDGB3SWuInbYniepNqAPFQr0y yaCBn3tBhnKGMIwmRku3 =GYVu -----END PGP SIGNATURE-----

1 0

'virtualenv -p jython' leaves 'pip' non-executable
by Tres Seaver 03 Jun '15

03 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Trying to get 'tox -e jython' to work: - ---------------------------- %< ---------------------------- $ file `which jython` /home/tseaver/bin/jython: symbolic link to `/opt/jython-2.7.0/bin/jython' $ /opt/Python-2.7.9/bin/pip --version pip 7.0.3 from /opt/Python-2.7.9/lib/python2.7/site-packages/pip-7.0.3-py2.7.egg (python 2.7) $ /opt/Python-2.7.9/bin/virtualenv --version 13.0.3 $ /opt/Python-2.7.9/bin/tox --version 2.0.2 imported from /opt/Python-2.7.9/lib/python2.7/site-packages/tox-2.0.2-py2.7.egg/tox/__init__.pyc $ git clone git@github.com:zopefoundation/zope.event Cloning into 'zope.event'... remote: Counting objects: 531, done. remote: Total 531 (delta 0), reused 0 (delta 0), pack-reused 531 Receiving objects: 100% (531/531), 84.80 KiB, done. Resolving deltas: 100% (288/288), done. $ /opt/Python-2.7.9/bin/tox -e jython GLOB sdist-make: /tmp/zope.event/setup.py jython create: /tmp/zope.event/.tox/jython jython inst: /tmp/zope.event/.tox/dist/zope.event-4.0.4.dev0.zip ERROR: invocation failed (errno 13), args: [local('/tmp/zope.event/.tox/jython/bin/pip'), 'install', '/tmp/zope.event/.tox/dist/zope.event-4.0.4.dev0.zip'], cwd: /tmp/zope.event Traceback (most recent call last): File "/opt/Python-2.7.9/bin/tox", line 9, in <module> load_entry_point('tox==2.0.2', 'console_scripts', 'tox')() ... File "/opt/Python-2.7.9/lib/python2.7/subprocess.py", line 1335, in _execute_child raise child_exception OSError: [Errno 13] Permission denied $ ls -laF .tox/jython/bin total 64 drwxrwxr-x 2 tseaver tseaver 4096 Jun 3 13:40 ./ drwxrwxr-x 6 tseaver tseaver 4096 Jun 3 13:40 ../ - -rw-rw-r-- 1 tseaver tseaver 2208 Jun 3 13:40 activate - -rw-rw-r-- 1 tseaver tseaver 1264 Jun 3 13:40 activate.csh - -rw-rw-r-- 1 tseaver tseaver 2477 Jun 3 13:40 activate.fish - -rw-rw-r-- 1 tseaver tseaver 1137 Jun 3 13:40 activate_this.py - -rw-rw-r-- 1 tseaver tseaver 255 Jun 3 13:40 easy_install - -rw-rw-r-- 1 tseaver tseaver 255 Jun 3 13:40 easy_install-2.7 - -rwxrwxr-x 1 tseaver tseaver 15055 Jun 3 13:40 jython* - -rw-rw-r-- 1 tseaver tseaver 227 Jun 3 13:40 pip - -rw-rw-r-- 1 tseaver tseaver 227 Jun 3 13:40 pip2 - -rw-rw-r-- 1 tseaver tseaver 227 Jun 3 13:40 pip2.7 lrwxrwxrwx 1 tseaver tseaver 6 Jun 3 13:40 python -> jython* lrwxrwxrwx 1 tseaver tseaver 6 Jun 3 13:40 python2 -> jython* lrwxrwxrwx 1 tseaver tseaver 6 Jun 3 13:40 python2.7 -> jython* - -rw-rw-r-- 1 tseaver tseaver 234 Jun 3 13:40 wheel - ---------------------------- %< ---------------------------- If I make the 'pip' script executable, then 'tox -e jython' runs: - ---------------------------- %< ---------------------------- $ chmod a+x .tox/jython/bin/pip $ tox -e jython GLOB sdist-make: /tmp/zope.event/setup.py jython inst-nodeps: /tmp/zope.event/.tox/dist/zope.event-4.0.4.dev0.zip jython installed: -f file:///home/tseaver/.pip/wheels,wheel==0.24.0,zope.event==4.0.4.dev0 jython runtests: PYTHONHASHSEED='441626771' jython runtests: commands[0] | python setup.py -q test -q warning: no previously-included files matching '*.dll' found anywhere in distribution warning: no previously-included files matching '*.pyc' found anywhere in distribution warning: no previously-included files matching '*.pyo' found anywhere in distribution warning: no previously-included files matching '*.so' found anywhere in distribution warning: no previously-included files matching '*.class' found anywhere in distribution .. - ---------------------------------------------------------------------- Ran 2 tests in 0.004s OK ___________________________________ summary ____________________________________ jython: commands succeeded congratulations :) - ---------------------------- %< ---------------------------- So, leaving tox out of the picture: - ---------------------------- %< ---------------------------- $ /opt/Python-2.7.9/bin/virtualenv -p jython foobar Running virtualenv with interpreter /home/tseaver/bin/jython Cannot find file /opt/jython-2.7.0/Include (bad symlink) New jython executable in foobar/bin/jython Installing setuptools, pip, wheel...done. $ ll foobar/bin/ total 64 drwxrwxr-x 2 tseaver tseaver 4096 Jun 3 13:46 ./ drwxrwxr-x 5 tseaver tseaver 4096 Jun 3 13:45 ../ - -rw-rw-r-- 1 tseaver tseaver 2192 Jun 3 13:46 activate - -rw-rw-r-- 1 tseaver tseaver 1248 Jun 3 13:46 activate.csh - -rw-rw-r-- 1 tseaver tseaver 2461 Jun 3 13:46 activate.fish - -rw-rw-r-- 1 tseaver tseaver 1137 Jun 3 13:46 activate_this.py - -rw-rw-r-- 1 tseaver tseaver 239 Jun 3 13:46 easy_install - -rw-rw-r-- 1 tseaver tseaver 239 Jun 3 13:46 easy_install-2.7 - -rwxrwxr-x 1 tseaver tseaver 15055 Jun 3 13:45 jython* - -rw-rw-r-- 1 tseaver tseaver 211 Jun 3 13:46 pip - -rw-rw-r-- 1 tseaver tseaver 211 Jun 3 13:46 pip2 - -rw-rw-r-- 1 tseaver tseaver 211 Jun 3 13:46 pip2.7 lrwxrwxrwx 1 tseaver tseaver 6 Jun 3 13:45 python -> jython* lrwxrwxrwx 1 tseaver tseaver 6 Jun 3 13:45 python2 -> jython* lrwxrwxrwx 1 tseaver tseaver 6 Jun 3 13:45 python2.7 -> jython* - -rw-rw-r-- 1 tseaver tseaver 218 Jun 3 13:46 wheel - ---------------------------- %< ---------------------------- None of the scripts are being marked as executable. I don't know whether this is a virtualenv issue, a jython issue, or a setuptools issue. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJVbz80AAoJEPKpaDSJE9HYg2EP/2sWlshPGokrrhOZYV/8YgcM IFNa2JlwKNwPefKtQ7VThrIqYHCTo8UuLC+6mv1JFvXIT50dTubOFeLP2ddR9X1f Ma5kqwlCs+lf1VhqWbA5BIkg+p3GH+l/CImudJOijxF2Lvlx1sHvIOTZwgU1qYvG cpMAOW5D9rT34oU7SEf6mIGro8cGVa3nEMsp8optU7iOZTzvgQG1nyYknfBJquca jwjwBOgrxaZkIaYrCyFWspR8sdPaWs+9S4qR7RsXkCWYHbfjtNKObJB4CPw4VdIV S0M16pz+znrY3nBggrCFzLAyJQje2E5mwNF1BDMKCrWTbUbdLmpbWMdV0//A68kP yricqNoH5Juw5PVCl5AiP49mIAvBUWipyD57kUVNP4ndlU23DMiC7/ClqS66HSw/ HCiThu50wVwZ4SYX/YOGmPorQKtmntLbLhGx2Oj1f74YoqVtcrTUbqeFG0MIW2W5 EU8IHy3k9n8hVacP9bm0zipUAX5/AJe+vS8eA+14B9pbU690hLK4pQZ8EYM2Dn87 mT7ii9IKgXUElybMWqR5v1w3kwbj/lRZbFqJ59x2cE0Kar1z5P95Eij6GgRP5sBw 6EdtK/35HVOk5K51Wkd7AWfVawSYRV9NoPxFFNcj3l5MqyQI0ewt85KpuYdeHYv3 w/9dWcP6PNXmDxA2VXA6 =eZat -----END PGP SIGNATURE-----

1 0

pip can't find header file for extension module, but `python setup.py install` works fine
by AJ Friend 02 Jun '15

02 Jun '15

Hi, I'm trying to write a new `setup.py` file for an extension module to wrap a C library (https://github.com/cvxgrp/scs). The current `setup.py` file imports numpy. I'm trying to delay that import statement until setuptools has a chance to install numpy if it's not already installed. I'm trying to do that with this bit of code: from setuptools.command.build_ext import build_ext as _build_ext class build_ext(_build_ext): def finalize_options(self): _build_ext.finalize_options(self) # Prevent numpy from thinking it is still in its setup process: __builtins__.__NUMPY_SETUP__ = False import numpy self.include_dirs += ext['include_dirs'] + [numpy.get_include()] Running `python setup.py install` seems to work fine on my OSX machine, but when I run `pip install .` in the directory with `setup.py`, I get a clang error that it can't find one of the header files. Any idea why that would be happening? Could it have anything to do with the relative path I'm giving for the include directories? Also, I had trouble finding good documentation on subclassing build_ext. Does anyone know if setting self.include_dirs overwrites or appends to the include_dirs attribute of an Extension object defined later in setup.py? For the curious, my current attempt at setup.py is athttps://github.com/ajfriend/scs/blob/setup2/python/setup.py. The original can be found in the same directory. More generally, since I'm new to python packaging, I'm not sure how well or correctly I've written my `setup.py` file. Any feedback on doing things correctly would be appreciated. Thanks, AJ

4 4

distutils package includes, package system includes, and environment-defined system includes
by Poor Yorick 02 Jun '15

02 Jun '15

I maintain a software collection that installs to an alternate prefix, and some of the longstanding issues I've seen with Python packages is that distutils doesn't seem to have any mechanism to allow a package build script to distinguish between project include directories and system include directories, and therefore include_dirs gets used for both purposes. The main issue is that project include directories should preceed anything specified in CPPFLAGS, whereas system include directories should follow CPPFLAGS. I've had a look at distutils2 and the situation is pretty much the same there. I finally decided to spend some time exploring this issue, and ended up creating a fairly extensive modification of the distutils that was shipped with Python-2.7.9, and also of the numpy and scipy packages. They take the approach of having cc_args precede the CPPFLAGS. This leaves extra_compile_args as a possible mechanism for system includes. Links to my patches are below. So far I like the effect they've had. Adding parsed environment variables to "extensions" is a little beyond its stated scope, but it has the benefit of unifying the treatment of command line options and of giving the user the opportunity to bind options tightly to the compiler command by adding options there, or to leave them, for example, in CFLAGS, where they can potentially be overriden by the package distribution. I also like the fact that the modifications make "compiler_exe" and "compiler_so" disappear, and leave "compiler", "compiler_flags_so", and "compiler_flags_exe" instead. That seems like a a cleaner model of the commands involved. I'm considering adding a "sysincludedirs" argument to Extension(). Using the disutils packaged with Python-2.7.9, numpy wasn't doing the right thing, and compiler flags weren't making it into the Fortran command lines. with these modifications and the numpy modifications, things are working better. I would appreciate any feedback anyone interested might have after glancing over the patches. http://dpaste.com/215AF8J http://dpaste.com/0K94JJ2 -- Yorick

1 0