Mailman 3 September 2016 - Distutils-SIG

PyPi not allowing duplicate filenames
by Chris Barker 20 Apr '20

20 Apr '20

Hi all, PyPi does not allow duplicate file names -- this makes lots of sense, because you really don't want people to go to PyPi one day and grab a file, and then go there another day, grab a file with exactly the same name, and have it be a different file. However.... We are all too human, and make mistakes when doing a release. All to often someone pushed a broken file up to PyPi, often realizes it pretty quickly -- before anyone has a chance to even download it (or only the dev team as, for testing...). In fact, I was in a sprint last summer, and we decided to push our package up to PyPi -- granted, we were all careless amateurish noobs, but we ended up making I think 4! minor version bumps because we had done something stupid in the sdist. Also -- the latest numpy release got caught in this, too: """ * We ran into a problem with pipy not allowing reuse of filenames and a resulting proliferation of *.*.*.postN releases. Not only were the names getting out of hand, some packages were unable to work with the postN suffix. """ So -- I propose that PyPi allow projects to replace existing files if they REALLY REALLY want to. You should have to jump through all sorts of hoops, and make it really clear that it is a BAD IDEA in the general case, but it'd be good to have it be possible. After all -- PyPi does not take on responsibility for anything else about what's in those packages, and Python itself is all about "we're all consenting adults here" I suppose we could even put in some heuristics about how long the file as been there, how many times it's been downloaded, etc. Just a thought.....I really hate systems that don't let me roll back mistakes, even when I discover them almost immediately... -CHB -- Christopher Barker, Ph.D. Oceanographer Emergency Response Division NOAA/NOS/OR&R (206) 526-6959 voice 7600 Sand Point Way NE (206) 526-6329 fax Seattle, WA 98115 (206) 526-6317 main reception Chris.Barker(a)noaa.gov

13 24

ImportError running 'test' on namespace package - other package in namespace not found
by Jason R. Coombs 17 Apr '20

17 Apr '20

I've got two projects: mynamespace.myprojectA and mynamespace.myprojectB myprojectB depends on myprojectA. I'm using setuptools 0.6c8 to manage both projects. Both projects are registered using 'setup develop'. Both projects are accessible from an interactive interpreter: PS C:\Users\me\projects> python Python 2.5.2 (r252:60911, Feb 21 2008, 13:11:45) [MSC v.1310 32 bit (Intel)] on win32 Type "help", "copyright", "credits" or "license" for more information. >>> import mynamespace.myprojectA >>> import mynamespace.myprojectB >>> from mynamespace.myprojectA import mymoduleZ However, when I run 'setup test' in myprojectB, the tests fail with File ".mymoduleZ.py", line NNN, in [some context] from mynamespace.myprojectA.mymoduleZ import MyClassC ImportError: No module named myprojectA.mymoduleZ In setup.py, the test_suite is nose.collector. I searched and couldn't find anyone else with this problem. Is this a supported configuration? Is there something I can do to make tests work with interdependent projects with the same root namespace? If there's not something obvious I should be doing differently, I'm happy to put together a minimal test case that reproduces the problem. Any suggestions are appreciated. Sincerely, Jason R. Coombs

3 6

Surviving a Compromise of PyPI - PEP 458 and 480
by Vladimir Diaz 12 Feb '20

12 Feb '20

Hello everyone, I am a research programmer at the NYU School of Engineering. My colleagues (Trishank Kuppusamy and Justin Cappos) and I are requesting community feedback on our proposal, "Surviving a Compromise of PyPI." The two-stage proposal can be reviewed online at: PEP 458 http://legacy.python.org/dev/peps/pep-0458/ PEP 480 http://legacy.python.org/dev/peps/pep-0480/ Summary of the Proposal: "Surviving a Compromise of PyPI" proposes how the Python Package Index (PyPI) can be amended to better protect end users from altered or malicious packages, and to minimize the extent of PyPI compromises against affected users. The proposed integration allows package managers such as pip to be more secure against various types of security attacks on PyPI and defend end users from attackers responding to package requests. Specifically, these PEPs describe how PyPI processes should be adapted to generate and incorporate repository metadata, which are signed text files that describe the packages and metadata available on PyPI. Package managers request (along with the packages) the metadata on PyPI to verify the authenticity of packages before they are installed. The changes to PyPI and tools will be minimal by leveraging a library, The Update Framework <https://github.com/theupdateframework/tuf>, that generates and transparently validates the relevant metadata. The first stage of the proposal (PEP 458 <http://legacy.python.org/dev/peps/pep-0458/>) uses a basic security model that supports verification of PyPI packages signed with cryptographic keys stored on PyPI, requires no action from developers and end users, and protects against malicious CDNs and public mirrors. To support continuous delivery of uploaded packages, PyPI administrators sign for uploaded packages with an online key stored on PyPI infrastructure. This level of security prevents packages from being accidentally or deliberately tampered with by a mirror or a CDN because the mirror or CDN will not have any of the keys required to sign for projects. The second stage of the proposal (PEP 480 <http://legacy.python.org/dev/peps/pep-0480/>) is an extension to the basic security model (discussed in PEP 458) that supports end-to-end verification of signed packages. End-to-end signing allows both PyPI and developers to sign for the packages that are downloaded by end users. If the PyPI infrastructure were to be compromised, attackers would be unable to serve malicious versions of these packages without access to the project's developer key. As in PEP 458, no additional action is required by end users. However, PyPI administrators will need to periodically (perhaps every few months) sign metadata with an offline key. PEP 480 also proposes an easy-to-use key management solution for developers, how to interface with a potential build farm on PyPI infrastructure, and discusses the security benefits of end-to-end signing. The second stage of the proposal simultaneously supports real-time project registration and developer signatures, and when configured to maximize security on PyPI, less than 1% of end users will be at risk even if an attacker controls PyPI and goes undetected for a month. We thank Nick Coghlan and Donald Stufft for their valuable contributions, and Giovanni Bajo and Anatoly Techtonik for their feedback. Thanks, PEP 458 & 480 authors.

7 53

Upgrading dependencies
by Charlie Moad 29 Apr '18

29 Apr '18

Is it currently possible to upgrade dependencies as well when upgrading a packages? If not, this would be a really nice feature to add to easy_install. Maybe a call like: easy_install --upgrade --upgrade-deps Package Obviously it makes sense to leave this off by default. Thanks, Charlie

2 1

Changes to --find-links and --upgrade in SVN
by Phillip J. Eby 29 Apr '18

29 Apr '18

Elvelind Grandin reported a problem with the "develop" command that turned out to be a flaw in its --find-links support. Specifically, it wasn't ever processing the links. :) In the process of fixing it, I wound up cleaning up an annoying (to me, at least) quirk of the previous workings of --find-links. It used to be that find-links would always be processed first, no matter what, even if you were doing a completely local operation. This would've been especially annoying if it carried over into "develop", so I made some changes. Now, if an item passed to --find-links is local (a filename or file: URL), or a direct link to an egg or other distribution, it is indexed immediately. Remote URLs are now only retrieved if a dependency can't be resolved locally, or if you use the -U or --upgrade options (this goes for "develop" too). Note that this is a behavior change for easy_install, which was effectively treating --find-links as though you'd specified --upgrade in certain cases. So, if you're used to getting upgrades downloaded as a result of using --find-links, please note that this will no longer happen. EasyInstall will now *only* go online if a dependency can't be resolved locally, if -U or --upgrade is used, or if you provided suitable direct URLs via an argument or --find-links, or via a link in a local .html file.

2 1

Problems with svn in windows
by Sharky On PTNet 29 Apr '18

29 Apr '18

Hi, I´m trying to do "easy_install setuptools==dev" in a windows box but have an error with svn command. """... 'svn' is not recognized as an internal or external command, ...""" I have installed TortoiseSVN but it seems that don't have command line, is all with the Explorer. Can you tell me what client I may use in windows? Thanks for all, Helio Pereira Sharky @ PTNet

3 2

local development scenarios
by tgreenwood 29 Apr '18

29 Apr '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm new to distutils/and the egg system. I have not researched the archives as much as I should, so please excuse me if this is familiar territory... Q: Is it possible for dependency checks to work for non pipy deployed eggs? - A.egg - B.egg (setup_requires and install_requires A.egg) - email A and B eggs to friend - tell friend to : easy_install B - but B.egg does not install A...in fact, in my test case, it fails b/c it cannot find A in pipy - in this example, what happens if friend does not have net connection on target machine? how can they install from the eggs alone and get the dep checking to work? Q: How does my friend run the unittests on the egg that they have just installed? As I am developing, I frequently run the unittests and after every bdist_egg build, I also run the unit tests that way, too. How can the consumer do the same? Q: One of my apps is a command line app, say foo.py is a command line app that takes arg1, arg2,... How can the user run this app when it is encased in an egg? Q: How do I define my own pipy? While I like the idea of deploying there for the overall community, I don't want to send my half baked code into the wild. But I'd like to try the general functionality of having a deploy site for my beta customers. How can I set this up? Thanks in advance. - -Todd -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDl9Hfz6uXX4lQc/URAnY4AJ47DFHL/cpEltmqoUyGqzhsK5FjRACgt01v akc3Wh3IOXVv2jiS8TszhuE= =Rv/x -----END PGP SIGNATURE-----

5 12

Choice of dependencies?
by John J Lee 29 Apr '18

29 Apr '18

Is it possible for a package to depend on one of several packages, with the user having the option to pick? For example, my package P might depend on package A, plus either package B or package C. I know I could (ab)use extras_require, but in my case this is a real dependency rather than an optional extra. The other option I have is to just pick one of the dependencies (B or C in my example above), and thereby force people to install it even though it's not strictly required. Neither option seems particularly attractive. John

3 6

setuptools doc patch
by John J Lee 29 Apr '18

29 Apr '18

The comma removed by the patch below implies that users working from a Subversion checkout should not use EasyInstall to periodically fetch the latest version. That's not what you intended to say, I assume? http://peak.telecommunity.com/DevCenter/setuptools You should also inform your users of the need to run this command, if they -are working from a Subversion checkout, rather than using EasyInstall to +are working from a Subversion checkout rather than using EasyInstall to periodically fetch the latest version. Hmm, probably much better than the patch above: -You should also inform your users of the need to run this command, if they -are working from a Subversion checkout, rather than using EasyInstall to -periodically fetch the latest version. +If your users are working from a Subversion checkout rather than using +EasyInstall, you should also inform them of the need to run this command +to periodically fetch the latest version. John

2 2

Re: [Distutils] distutils install probs on suse 9.0
by Mats Wichmann 29 Apr '18

29 Apr '18

At 05:43 AM 5/18/2004, David Handy wrote: >On Tue, 18 May 2004, Floris van der Tak wrote: > >> my attempt to install the distutils on suse 9.0 (which provides python >> 2.3) fails: > >Why are you installing distutils on a system that already has Python 2.3 >installed? Python 2.3 normally comes with distutils as part of the Python >standard library. > >Did suse distribute a version of Python that had distutils removed? It should come from python-devel

2 1

Sample setup.py for Numeric Python
by Greg Ward 29 Apr '18

29 Apr '18

Hi again -- [cc'd to Paul Dubois: you said you weren't following the distutils sig anymore, but this directly concerns NumPy and I'd like to get your input!] here's that sample setup.py for NumPy. See below for discussion (and questions!). ------------------------------------------------------------------------ #!/usr/bin/env python # Setup script example for building the Numeric extension to Python. # This does sucessfully compile all the .dlls. Nothing happens # with the .py files currently. # Move this file to the Numerical directory of the LLNL numpy # distribution and run as: # python numpysetup.py --verbose build_ext # # created 1999/08 Perry Stoll __rcsid__ = "$Id: numpysetup.py,v 1.1 1999/09/12 20:42:48 gward Exp $" from distutils.core import setup setup (name = "numerical", version = "0.01", description = "Numerical Extension to Python", url = "http://www.python.org/sigs/matrix-sig/", ext_modules = [ ( '_numpy', { 'sources' : [ 'Src/_numpymodule.c', 'Src/arrayobject.c', 'Src/ufuncobject.c' ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/numpy.def' } ), ( 'multiarray', { 'sources' : ['Src/multiarraymodule.c'], 'include_dirs' : ['./Include'], 'def_file': 'Src/multiarray.def' } ), ( 'umath', { 'sources': ['Src/umathmodule.c'], 'include_dirs' : ['./Include'], 'def_file' : 'Src/umath.def' } ), ( 'fftpack', { 'sources': ['Src/fftpackmodule.c', 'Src/fftpack.c'], 'include_dirs' : ['./Include'], 'def_file' : 'Src/fftpack.def' } ), ( 'lapack_lite', { 'sources' : [ 'Src/lapack_litemodule.c', 'Src/dlapack_lite.c', 'Src/zlapack_lite.c', 'Src/blas_lite.c', 'Src/f2c_lite.c' ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/lapack_lite.def' } ), ( 'ranlib', { 'sources': ['Src/ranlibmodule.c', 'Src/ranlib.c', 'Src/com.c', 'Src/linpack.c', ], 'include_dirs' : ['./Include'], 'def_file' : 'Src/ranlib.def' } ), ] ) ------------------------------------------------------------------------ First, what d'you think? Too clunky and verbose? Too much information for each extension? I kind of think so, but I'm not sure how to reduce it elegantly. Right now, the internal data structures needed to compile a module are pretty obviously exposed: is this a good thing? Or should there be some more compact form for setup.py that will be expanded later into the full glory we see above? I've already made one small step towards reducing the amount of cruft by factoring 'include_dirs' out and supplying it directly as a parameter to 'setup()'. (But that needs code not in the CVS archive yet, so I've left the sample setup.py the same for now.) The next thing I'd like to do is get that damn "def_file" out of there. To support it in MSVCCompiler, there's already an ugly hack that unnecessarily affects both the UnixCCompiler and CCompiler classes, and I want to get rid of that. (I refer to passing the 'build_info' dictionary into the compiler classes, if you're familiar with the code -- that dictionary is part of the Distutils extension-building system, and should not propagate into the more general compiler classes.) But I don't want to give these weird "def file" things standing on the order of source files, object files, libraries, etc., because they seem to me to be a bizarre artifact of one particular compiler, rather than something present in a wide range of C/C++ compilers. Based on the NumPy model, it seems like there's a not-too-kludgy way to handle this problem. Namely: if building extension "foo": if file "foo.def" found in same directory as "foo.c" add "/def:foo.def" to MSVC command line this will of course require some platform-specific code in the build_ext command class, but I figured that was coming eventually, so why put it off? ;-) To make this hack work with NumPy, one change would be necessary: rename Src/numpy.def to Src/_numpy.def to match Src/_numpy.c, which implements the _numpy module. Would this be too much to ask of NumPy? (Paul?) What about other module distributions that support MSVC++ and thus ship with "def" files? Could they be made to accomodate this scheme? Thanks for your feedback -- Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

4 5

Can now compile simple extensions
by Greg Ward 29 Apr '18

29 Apr '18

Hi all -- at long last, I found the time to hack in the ability to compile extension modules to the Distutils. Mainly, this meant adding a 'build_ext' command which uses a CCompiler instance for all its dirty work. I also had to add a few methods to CCompiler (and, of course, UnixCCompiler) to make this work. And I added a new module, 'spawn', which takes care of running sub-programs more efficiently and robustly (no shell involved) than os.system. That's needed, obviously, so we can run the compiler! If you're in the mood for grubbing over raw source code, then get the latest from CVS or download a current snapshot. See http://www.python.org/sigs/distutils-sig/implementation.html for a link to the code snapshot. I'm still waiting for more subclasses of CCompiler to appear. At the very least, we're going to need MSVCCompiler to build extensions on Windows. Any takers? Also, someone who knows the Mac, and how to run compilers programmatically there, will have to figure out how to write a Mac-specific concrete CCompiler subclass. The spawn module also needs a bit of work to be portable. I suspect that _win32_spawn() (the intended analog to my _posix_spawn()) will be easy to implement, if it even needs to go in a separate function at all. It looks from the Python Library documentation for 1.5.2 that the os.spawnv() function is all we need, but it's a bit hard to figure out just what's needed. Windows wizards, please take a look at the 'spawn()' function and see if you can make it work on Windows. As for actually compiling extensions: well, if you can figure out the build_ext command, go ahead and give it a whirl. It's a bit cryptic right now, since there's no documentation and no example setup.py. (I have a working example at home, but it's not available online.) If you feel up to it, though, see if you can read the code and figure out what's going on. I'm just hoping *I'll* be able to figure out what's going on when I get back from the O'Reilly conference next week... ;-) Enjoy -- Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

2 1

Two fixes (at last)
by Greg Ward 29 Apr '18

29 Apr '18

Hi all -- at long last, I have fixed two problems that a couple people noticed a while ago: * I folded in Amos Latteier's NT patches almost verbatim -- just changed an `os.path.sep == "/"' to `os.name == "posix"' and added some comments bitching about the inadequacy of the current library installation model (I think this is Python's fault, but for now Distutils is slavishly aping the situation in Python 1.5.x) * I fixed the problem whereby running "setup.py install" without doing anything else caused a crash (because 'build' hadn't yet been run). Now, the 'install' command automatically runs 'build' before doing anything; to make this bearable, I added a 'have_run' dictionary to the Distribution class to keep track of which commands have been run. So now not only are command classes singletons, but their 'run' method can only be invoked once -- both restrictions enforced by Distribution. The code is checked into CVS, or you can download a snapshot at http://www.python.org/sigs/distutils-sig/distutils-19990607.tar.gz Hope someone (Amos?) can try the new version under NT. Any takers for Mac OS? BTW, all parties involved in the Great "Where Do We Install Stuff?" Debate should take a good, hard look at the 'set_final_options()' method of the Install class in distutils/install.py; this is where all the policy decisions about where to install files are made. Currently it apes the Python 1.5 situation as closely as I could figure it out. Obviously, this is subject to change -- I just don't know to *what* it will change! Greg -- Greg Ward - software developer gward(a)cnri.reston.va.us Corporation for National Research Initiatives 1895 Preston White Drive voice: +1-703-620-8990 Reston, Virginia, USA 20191-5434 fax: +1-703-620-0913

2 1

Package versioning
by Timothy Docker 29 Apr '18

29 Apr '18

Hi all, I've been aware that the distutils sig has been simmerring away, but until recently it has not been directly relevant to what I do. I like the look of the proposed api, but have one question. Will this support an installed system that has multiple versions of the same package installed simultaneously? If not, then this would seem to be a significant limitation, especially when dependencies between packages are considered. Assuming it does, then how will this be achieved? I am presently managing this with a messy arrangement of symlinks. A package is installed with its version number in it's name, and a separate directory is created for an application with links from the unversioned package name to the versioned one. Then I just set the pythonpath to this directory. A sample of what the directory looks like is shown below. I'm sure there is a better solution that this, and I'm not sure that this would work under windows anyway (does windows have symlinks?). So, has this SIG considered such versioning issues yet? Cheers, Tim -------------------------------------------------------------- Tim Docker timd(a)macquarie.com.au Quantative Applications Division Macquarie Bank -------------------------------------------------------------- qad16:qad $ ls -l lib/python/ total 110 drwxr-xr-x 2 mts mts 512 Nov 11 11:23 1.1 -r--r----- 1 root mts 45172 Sep 1 1998 cdrmodule_0_7_1.so drwxr-xr-x 2 mts mts 512 Sep 1 1998 chart_1_1 drwxr-xr-x 3 mts mts 512 Sep 1 1998 Fnorb_0_7_1 dr-xr-x--- 3 mts mts 512 Nov 11 11:21 Fnorb_0_8 drwxr-xr-x 3 mts mts 1536 Mar 3 12:45 mts_1_1 dr-xr-x--- 7 mts mts 512 Nov 11 11:22 OpenGL_1_5_1 dr-xr-x--- 2 mts mts 1024 Nov 11 11:23 PIL_0_3 drwxr-xr-x 3 mts mts 512 Sep 1 1998 Pmw_0_7 dr-xr-x--- 2 mts mts 512 Nov 11 11:21 v3d_1_1 qad16:qad $ ls -l lib/python/1.1 total 30 lrwxrwxrwx 1 root other 29 Apr 10 10:43 _glumodule.so -> ../OpenGL_1_5_1/_glumodule.so lrwxrwxrwx 1 root other 30 Apr 10 10:43 _glutmodule.so -> ../OpenGL_1_5_1/_glutmodule.so lrwxrwxrwx 1 root other 22 Apr 10 10:43 _imaging.so -> ../PIL_0_3/_imaging.so lrwxrwxrwx 1 root other 36 Apr 10 10:43 _opengl_nummodule.so -> ../OpenGL_1_5_1/_opengl_nummodule.so lrwxrwxrwx 1 root other 27 Apr 10 10:43 _tkinter.so -> ../OpenGL_1_5_1/_tkinter.so lrwxrwxrwx 1 mts mts 21 Apr 10 10:43 cdrmodule.so -> ../cdrmodule_0_7_1.so lrwxrwxrwx 1 mts mts 12 Apr 10 10:43 chart -> ../chart_1_1 lrwxrwxrwx 1 root other 12 Apr 10 10:43 Fnorb -> ../Fnorb_0_8 lrwxrwxrwx 1 mts mts 12 Apr 10 10:43 mts -> ../mts_1_1 lrwxrwxrwx 1 root other 15 Apr 10 10:43 OpenGL -> ../OpenGL_1_5_1 lrwxrwxrwx 1 root other 33 Apr 10 10:43 opengltrmodule.so -> ../OpenGL_1_5_1/opengltrmodule.so lrwxrwxrwx 1 root other 33 Apr 10 10:43 openglutil_num.so -> ../OpenGL_1_5_1/openglutil_num.so lrwxrwxrwx 1 root other 10 Apr 10 10:43 PIL -> ../PIL_0_3 lrwxrwxrwx 1 mts mts 10 Apr 10 10:43 Pmw -> ../Pmw_0_7 lrwxrwxrwx 1 root other 10 Apr 10 10:43 v3d -> ../v3d_1_1

3 2

[Distutils-sig] distutils charter and interscript
by John Skaller 29 Apr '18

29 Apr '18

3 2

Versioned trove classifiers for Django
by James Bennett 06 Apr '17

06 Apr '17

Following up on some IRC discussion with other folks: There is precedent (Plone) for PyPI trove classifiers corresponding to particular versions of a framework. So I'd like to get feedback on the idea of expanding that, particularly in the case of Django. The rationale here is that the ecosystem of Django-related packages is quite large, but -- as I know all too well from a project I'm working on literally at this moment -- it can be difficult to ensure that all of one's dependencies are compatible with the version of Django one happens to be using. Adding trove classifier support at the level of individual versions of Django would, I think, greatly simplify this: tools could easily analyze which packages are compatible with an end user's chosen version, there'd be far less manual guesswork, etc., and the rate of creation of new classifiers would be relatively low (we tend to have one X.Y release/year or thereabouts, and that's the level of granularity needed). Assuming there's consensus around the idea of doing this, what would be the correct procedure for getting such classifiers set up and maintained?

5 17

Current Python packaging status (from my point of view)
by Nick Coghlan 09 Nov '16

09 Nov '16

Hi folks, Prompted by a few posts I read recently about the current state of the Python packaging ecosystem, I figured it made sense to put together an article summarising my own perspective on the current state of things: http://www.curiousefficiency.org/posts/2016/09/python-packaging-ecosystem.h… It's pretty long, so the short version tailored specifically for the distutils-sig audience would be: * restating the point that pip & conda solve different problems, so while there's some overlap in their core capabilities, neither is a substitute for the other * we've actually managed to put some pretty hard problems behind us in the last few years, so my thanks to everyone that's played a part in that process * some of the thorniest problems that still remain really do require proper funding of the core ecosystem infrastructure (most notably PyPI), which means that either commercial redistributors need to step up and handle the problem on behalf of their customers, or else the PSF needs to figure out alternative sources of funding (with "let's do both!" really being my preferred outcome on that front) Cheers, Nick. P.S. For the Twitter users amongst you, feel free to pass along my link to the article: https://twitter.com/ncoghlan_dev/status/777087670837088256 -- Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia

15 68

ANN: distlib 0.2.4 released on PyPI
by Vinay Sajip 30 Sep '16

30 Sep '16

I've just released version 0.2.4 of distlib on PyPI [1]. For newcomers, distlib is a library of packaging functionality which is intended to be usable as the basis for third-party packaging tools. The main changes in this release are as follows: * Updated to not fail during import if SSL is not available. * Changed project name comparisons to follow PEP 503. * Changed manifest and resources logic to work correctly under (upcoming) Python 3.6. * Updated Windows launchers with fixes to bugs related to argument-passing in shebang lines. A more detailed change log is available at [2]. Please try it out, and if you find any problems or have any suggestions for improvements, please give some feedback using the issue tracker! [3] Regards, Vinay Sajip [1] https://pypi.python.org/pypi/distlib/0.2.4 [2] https://goo.gl/M3kQzR [3] https://bitbucket.org/pypa/distlib/issues/new

1 0

Compatibility Tags and the Stable API
by Phil Thompson 27 Sep '16

27 Sep '16

I'm not sure how to interpret PEP 425 when it comes to packages containing C extension modules that use the limited Python API (PEP 384). The Python v3.4 version of the limited API is used so should the compatibility tag be... cp34-abi3-* That would mean that the 'cp34' Python tag would have to be interpreted as a minimum (rather than exact) requirement. Grateful for any clarification. Phil

4 6

When can we kill Python 2.6 support?
by Donald Stufft 20 Sep '16

20 Sep '16

The packaging tools generally support 2.6+ and 3.(2|3)+ and that's sort of been where they've been at for a while now. I would like to think about what we need to be to start considering Python 2.6 as "too old" to support. In pip we generally follow a usage based deprecation/removal of supported Pythons but we don't have any real guidelines for when something is at a low enough usage to consider it no longer supported and we instead just sort of wait until someone makes a case that it's "low enough". This issue tends to impact more than just pip, because once pip drops support for something people tend to start dropping it across the entire ecosystem and use pip's no longer supporting it as justification for doing so. I would like to take a look at Python 2.6 and try and figure out if we're at a point that we can deprecate and drop it, and if not what is such a point. Looking at pure usage numbers for "modern" versions of pip (6, 7, and 8) for downloading from PyPI I see the usage is ~3% of downloads are via Python 2.6. The only thing lower than Python 2.6 that is still supported is Python 3.3. Python 2.6 itself has been EOL since 2013-10-29 which is now just about 3 years ago. It's SSL module is not generally secure and requires the use of additional installed modules to get it to be so. I believe the only place to get a Python 2.6 that is "supported" is through the Enterprise-y Linux Distributions like RHEL/CentOS/etc. Do we think that a ~3% usage of Python 2.6 and being end-of-life'd for ~3 years is enough to start deprecating and dropping 2.6? If not what sort of threshold do we think is enough? It'd be nice to get the albatross of Python 2.6 support off from around our necks but I'm not sure how others feel. Obviously all of the existing versions of all of the tooling will still be fully functional so Python 2.6 users will simply need to not upgrade their tooling to continue to work, *but* it also means that they will be left out of new packaging features (and likewise, people can't rely on them if they still wish to support 2.6). Thoughts? — Donald Stufft

8 9

Re: [Distutils] Publicly Queryable Statistics
by Jason Antman 18 Sep '16

18 Sep '16

Donald, Thanks so much for all of your work on this. I know it's an old thread, but I've built a tool that generates some statistics from this information. It queries data for a given list of projects, or for all of a specific user's projects, caches the data locally on disk, and generates both a HTML report with a bunch of graphs, as well as download badges. For my own use, I'm running it cron'ed from my desktop once a night, and uploading the reports and badges to a public Amazon S3 bucket. The project is: https://pypi.org/project/pypi-download-stats/ Example output: http://jantman-personal-public.s3-website-us-east-1.amazonaws.com/pypi-stat… It's a bit rough around the edges, and currently doesn't have any unit tests - my hope is that this will be an interim solution until Warehouse has built-in stats, but I'd be happy to polish it up a bit as time allows if anyone finds it useful. Side note for Donald: It appears that the dataset currently contains data for 2016-01-22 to 2016-03-06 and 2016-05-22 to current. Is there any plan or possibility of backfilling either the 2016-03-07 to 2016-05-21 gap, or the older data? -Jason Antman

2 1

Module Installation Issues
by Mills, Ryan 16 Sep '16

16 Sep '16

I just recently downloaded Python 3.5 and cannot seem to install any packages like Numpy, etc. I have tried all the instructions on the website and keep getting errors: For example, when I type "python -m pip install Numpy" it returns a Syntax Error. I am completely new to Python so I must be missing something here - I haven't altered any files since installing it the other day. Do I use the Python IDLE Shell? Are there other packages I need to install first? Any help would be greatly appreciated. -Ryan Ryan Mills Quantitative Risk Analyst, Banking Officer [cid:image001.jpg@01CA3228.EF8AEBA0] Capital Analytics & Stress Testing 2000 McKinney Avenue, Suite 700 Dallas, TX 75201 214.932.6653 direct 20.6653 internal ryan.mills(a)texascapitalbank.com<mailto:%0bryan.mills@texascapitalbank.com> [cid:image001.jpg@01CA3228.EF8AEBA0] [TCB_horiz_Log_rgb] [cid:image004.jpg@01D20DA2.E1988D60] If you are not the addressee and have received this email in error, please notify me immediately. This email is confidential and may contain privileged or proprietary information that is unlawful for you to read, copy, distribute, disclose or otherwise use in any way.

13 29

Buoldout2 e setup.py: install_requires ignored
by Alessandro Dentella 14 Sep '16

14 Sep '16

Hi, I just migrated from buildout 1.7 to buildout 2.5. In this migration I stopped using a recipe that created a virtualenv as a part of buildout and I now use an external (basic) virtualenv to calll bootrap, so I can't compare the two configuration in a strict way. My problem is that now it seems that install_requires declared in setup.py are simply ignored, while all packages declared in the eggs directory are used/installed along with all the packages they depends on. I can't find what's wrong with my configuration, I report below a minimal setup that shows the problem. thanks in advance for any hints sandro *:-) sandro@bluff:/tmp/new$ cat buildout.cfg [buildout] parts = django eggs = django ipython django_extensions project-name = mytest [django] recipe = djangorecipe settings = settings eggs = ${buildout:eggs} ---------------------------------------------------- sandro@bluff:/tmp/new$ cat setup.py from setuptools import setup, find_packages setup( name = "example with buildout2", version = "0.1", author = "Sandro", author_email = "sandro(a)e-den.it", description = ("Sperem ghe la vaga ben"), license = "BSD", url = "http://hg.trepalchi.it/", #packages=['an_example_pypi_project', 'tests'], long_description="Bla bla", classifiers=[ "Development Status :: 3 - Alpha", "Topic :: Utilities", "License :: OSI Approved :: BSD License", ], install_requires=[ 'pyquery', ] ) The steps I do:: mkvirtualenv -p /usr/bin/python3 base3 /home/sandro/.virtualenvs/base3/bin/python3 bootstrap.py ./bin/buildout And I obtain bin/django where pyquery **is missing** $ cat bin/django #!/home/sandro/.virtualenvs/base3/bin/python3 import sys sys.path[0:0] = [ '/home/sandro/.buildout/eggs/Django-1.10.1-py3.5.egg', '/home/sandro/.buildout/eggs/ipython-5.0.0-py3.5.egg', '/home/sandro/.buildout/eggs/djangorecipe-2.2.1-py3.5.egg', '/home/sandro/.buildout/eggs/zc.recipe.egg-2.0.3-py3.5.egg', '/home/sandro/.buildout/eggs/zc.buildout-2.5.3-py3.5.egg', '/home/sandro/.buildout/eggs/pexpect-4.2.1-py3.5.egg', '/home/sandro/.buildout/eggs/Pygments-2.1.3-py3.5.egg', '/home/sandro/.buildout/eggs/prompt_toolkit-1.0.7-py3.5.egg', '/home/sandro/.buildout/eggs/traitlets-4.2.2-py3.5.egg', '/home/sandro/.buildout/eggs/simplegeneric-0.8.1-py3.5.egg', '/home/sandro/.buildout/eggs/pickleshare-0.7.4-py3.5.egg', '/home/sandro/.buildout/eggs/decorator-4.0.10-py3.5.egg', '/home/sandro/.buildout/eggs/setuptools-27.1.2-py3.5.egg', '/home/sandro/.buildout/eggs/ptyprocess-0.5.1-py3.5.egg', '/home/sandro/.buildout/eggs/wcwidth-0.1.7-py3.5.egg', '/home/sandro/.buildout/eggs/six-1.10.0-py3.5.egg', '/home/sandro/.buildout/eggs/ipython_genutils-0.1.0-py3.5.egg', '/tmp/new', ] import djangorecipe.binscripts if __name__ == '__main__': sys.exit(djangorecipe.binscripts.manage('project.settings')) -- Sandro Dentella *:-) http://trepalchi.it Il portale degli artisti http://www.reteisi.org Soluzioni libere per le scuole http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy

4 5

Code for inserting paths into system configuration?
by Matthew Brett 14 Sep '16

14 Sep '16

Hi, I was reflecting on the detail of putting pip user bin directories on the user's path, and was then thinking of making a tiny pip package like this: pip install pip_user_config python -m pip_user_config where the latter would cleverly insert the user bin directory into the user's configuration. Does anyone know of any code to do something like that? Best, Matthew

3 3

namespace_package
by KP 12 Sep '16

12 Sep '16

I'm not sure where the issue is, but when I specify a namespace_package in the setup.py file, I can indeed have multiple packages with the same base (foo.bar, foo.blah, etc...). The files all install in to the same directory. It drops the foo/__init__.py that would be doing the extend_path, and instead adds a ".pth" file that is a bit over my head. The problem is that it does not seem to traverse the entire sys.path to find multiple foo packages. If I do not specify namespace_packages and instead just use the pkgutil.extend_path, then this seems to allow the packages to be in multiple places in the sys.path. Is there something additional for the namespace_package that i need to specify in order for all of the sys.path to be checked? I'm using 18.5 setuptools....but I am not sure if this somehow ties in to wheel/pip, since I'm using that for the actual install.

4 19

[proposal] module dependency specification and overriding for packages
by Ronny Pfannschmidt 11 Sep '16

11 Sep '16

Hi, while trying to vendor packages that depend on six, i noticed a problematic implication it is impossible to do this without patching those modules, as such adding a fragile maintenance burden. in order to elevate that i propose creating a mechanism that allows to physically or virtually map sets of interdependent libraries (that are prepared for it into a sub-package of the package vendor-ing it this would elevate a few issues a) removing the need to patch b) making de-vendor-ing of exact versions trivial (just unpacked wheels and adding it to the sub-packages __path__) c) easing updates, as the vendor-ing turns into a process of fetching the wheels and unpacking them into the package folder i do have some implementation ideas, but i would like to hear the opinions of others before proposing an exact implementation -- Ronny

4 6

Improved Stats Features in Python
by Rui Sarmento 10 Sep '16

10 Sep '16

Dear Sirs, I've implemented some stats functions related to Factor Analysis in the statistics area. Specifically, the KMO test and the Bartlett test also. At this time I do not seem to find any module performing these tests. Is there any chance I could add these functions to a package in Python. What is the procedure to perform such contribution. Thank you very much in advance for the suggestions. Best Regards, Rui

3 8

Pep 440 question/clarification Version specifiers no "Or" available
by Matthias Bussonnier 09 Sep '16

09 Sep '16

Hi all, In the line of recent discussions[1] about releasing some packages only for some versions of Python. I was reading pep 440 and in particular the "Version specifier section". The following sentence caught my eye: > The comma (",") is equivalent to a logical and operator: a candidate version must match all given version clauses in order to match the specifier as a whole. Is there no way to have an "or" ? It seem to me that it might be useful for package wanting to express compatibility with `2.6`, `2.7` or `>3.3` for example, in the form `=~2.6 <or operator> =~3.3`. I completely agree that the use case is _limited_ and likely rare, I was just wondering if I'm missing something, if it was an oversight and if not if adding a section detailing that "or" was not considered, or that "or" was explicitly not included for X,Y,Z reason would be a good thing. Thanks, -- Matthias [1]:https://mail.python.org/pipermail/distutils-sig/2016-August/029604.html

4 5

Fwd: What is the official position on distutils?
by Sylvain Corlay 05 Sep '16

05 Sep '16

Hi Nick (re-sending to the list) On Sun, Sep 4, 2016 at 5:16 PM, Nick Coghlan <ncoghlan(a)gmail.com> wrote: > > It's important to note that one of our key goals in PyPA is to get to > a point where the API of a developer's publishing toolchain of choice > only depends on the *version of the publishing tools* they're using, > and not on the specific version of Python (as long as they're using a > supported version). Encouraging the expansion and increased use of the > distutils API runs counter to that goal in most cases (since it > encourages writing publication and distribution code that will only > work with newer versions of Python), but may sometimes make sense if > it's info that really is CPython centric, or if it's a feature > primarily aimed at tightly controlled environments that can > aggressively drop support for older versions. Today's state of things is that any project that is not a trivial pure-python module often has use of a combination of all three libraries: distutils, setuptools and pip in their setup.py and in a convoluted way. Newcomers to the toolchain look in similar projects for the right incantations that will fulfill their needs. We are pretty far from being in a state where good practices can even be defined. As a package author, I generally make sure that my need is not fulfilled by a proper usage of the standard library before adding a dependency to a third-party library, but packaging is an area where this does not work. Requiring pip only to know where distutils puts assets is pretty bad. Interestingly, on the subject of building extensions (where the has_flag method discussion applies), distutils.ccompiler is the only available tool and happens to not be monkey-patched by setuptools at the moment. Although setuptools re-defines buildext (and tries to get a version from cython first!) So it seems that there no real "right place" within setuptools to monkey-patch distutils' ccompiler. Sylvain

2 1

What is the official position on distutils?
by Brett Cannon 04 Sep '16

04 Sep '16

The discussion of Sylvain's proposed changes to distutils suggests that there isn't a clear-cut agreement or position of this SIG -- and thus Python -- on changes to distutils, its future, etc. Is there an official position I'm not aware of? If not, could we get one so we know how to handle any more proposed changes to distutils? For me personally (and to start this conversation if necessary), I view distutils as the package in the stdlib that handles building extension modules in the stdlib for Python. That view means that if something doesn't service that explicit goal then it shouldn't go into distutils. Now that we are moving down the road towards making the build step configurable I'm fine with saying that distutils is not expected to work for people other than Python itself and others can use setuptools, enscons, or other projects while we continue to improve the situation to where the build system is just something you specify in pyproject.toml to generate your wheel. IOW distutils is only exposed publicly because Python doesn't hide anything, but making it useful for the general case of direct usage by people is a non-goal of the package.

11 22

Re: [Distutils] What is the official position on distutils?
by Sylvain Corlay 04 Sep '16

04 Sep '16

Hi Steve, - I posted an on setuptools github https://github.com/pypa/ setuptools/issues/771 to ask the setuptools folks (and especially Jason) whether they would want such a feature. I still find it baffling that the preferred way to add distutils features would be to monkey-patch it via setuptools first and then to add it into distutils later, while my proposed approach was to add it to distutils and monkey patch for earlier versions of python. - Regarding the policy that you just nominated, does this apply to things that have been in pip for a long time? In the initial email that triggered this discussion, it was also question of adding the `pip.location.distutils_scheme` convenience function to distutils itself. Cf https://bugs.python.org/issue26955 and pip's implementation at https://github.com/pypa/pip/blob/281eb61b09d87765d7c2b92f6982b3fe76ccb0af/p… Indeed, the problem with certain distutils commands like `install_headers` is that the only way to retrieve the directory where things were installed is to instantiate a `distutils.dist.Distribution` object, which is not trivial to do. pip's distutils_scheme convenience function does it. This function is *about* distutils, and IMO should really be *in* distutils. Thanks, Sylvain On Sun, Sep 4, 2016 at 4:02 PM, Steve Dower <steve.dower(a)python.org> wrote: > "add it to setuptools first, and then add things to distutils where we > feel they're sufficiently stable to not need the benefit of the faster > setuptools update cycle" > > I nominate this as the official policy on API changes for distutils, with > regular maintenance mode policies applying to anything else. > > Top-posted from my Windows Phone > ------------------------------ > From: Nick Coghlan <ncoghlan(a)gmail.com> > Sent: ‎9/‎4/‎2016 2:19 > To: Sylvain Corlay <sylvain.corlay(a)gmail.com> > Cc: distutils sig <distutils-sig(a)python.org> > Subject: Re: [Distutils] What is the official position on distutils? > > On 4 September 2016 at 06:44, Sylvain Corlay <sylvain.corlay(a)gmail.com> > wrote: > > Hi Brett, > > > > On Sat, Sep 3, 2016 at 8:05 PM, Brett Cannon <brett(a)python.org> wrote: > >> > >> > >> If Jason is up for the responsibility that seems like a reasonable > >> approach to take. It also helps test out features in setuptools first > before > >> upstreaming it. > >> > > > > How do you see `has_flag` get into setuptools? By monkey-patching > distutils' > > ccompiler to have it aside of `has_function` when setuptools is imported? > > > > I find really weird the idea of adding this in a convoluted fashion > instead > > of allowing incremental improvement of distutils. > > The change to distutils would still be a plain patch to distutils, it > would just be accepted at the API design level in setuptools first. > > The problem you're running into right now isn't a technical one - it's > that there isn't anyone that currently feels like they have sufficient > design authority over the distutils API to accept your proposal, hence > Brett starting this thread to address that underlying recurring > question, rather than the specifics of your change. > > Jason *definitely* has that design authority over setuptools though, > and will be tasked with making any API additions available on older > versions of Python via setuptools regardless of what policy we adopt > for distutils maintenance, so if he's amenable to the idea, it makes > sense to me to invert the order we ask those questions: add it to > setuptools first, and then add things to distutils where we feel > they're sufficiently stable to not need the benefit of the faster > setuptools update cycle. > > Cheers, > Nick. > > -- > Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia > _______________________________________________ > Distutils-SIG maillist - Distutils-SIG(a)python.org > https://mail.python.org/mailman/listinfo/distutils-sig >

2 1

setup_requires: the obvious option(?)
by Antony Lee 03 Sep '16

03 Sep '16

Hi all, The `setup_requires` option to `setup()` is well-known to suffer from multiple issues. Most importantly, as it is a keyword argument to `setup()`, it appears too late for modules that may need to be imported for the build to occur (e.g., Cython, for which support must explicitly provided by setuptools itself rather than by letting Cython hook into it); additionally, there are various contorsions that people go to to avoid some `setup_requires` when not building the package (such as checking the value of `sys.argv`). `setup_requires` also uses `easy_install` rather than `pip`, but I do not see why this could not be fixed; let's focus on the first issue instead. If `setup_requires` appears too late to be useful, the obvious(?) option is to move it earlier: provide a function, say, `setuptools.setup_requires()`, that should be called *before* `setup()` itself, e.g.: from setuptools import setup, setup_requires setup_requires("numpy", needed_for=["build_ext"]) try: import numpy as np except ImportError: np = None setup(..., include_dirs=[np.get_include()] if np else []) When `setup.py` is invoked, either directly or by pip, upon the call to `setup_requires()`, if `sys.argv[0]` is in the `needed_for` kwarg, and at least one requirement is missing, `setup_requires()` calls asks pip to install the required packages (similarly to ` https://bitbucket.org/dholth/setup-requires`) in a temporary directory, and the whole Python process replaces itself (in the `os.execv()` sense) by a new call to `python setup.py` with this temporary directory prepended to the PYTHONPATH. In this new process, the arguments to `setup_requires()` are now available and we can proceed to the rest of `setup.py`. I feel like this idea is natural enough that someone must already have come up with it... but I may be missing something :-) Best, Antony

6 10

Accepting PEP 527 (reducing the variety of file types supported by PyPI)
by Nick Coghlan 02 Sep '16

02 Sep '16

Having reviewed the comments on the PEP 527 thread and the latest draft of the PEP, I'm now accepting the PEP. This means that: * supported sdist types will be reduced to .tar.gz and .zip * projects will need to choose one or the other for future releases * supported binary formats will be reduced to bdist_wheel and bdist_egg The problem that Maurits van Rees pointed out with ez_setup.py currently still specifically looking for a zip file and processing it accordingly can be resolved by setuptools settling on zip as its sdist publication format (unless/until ez_setup.py is changed to handle tar.gz). Regards, Nick. -- Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia

2 1