On 04 August 2000, Amos Latteier said:

I'm sending this to you directly since there seems to be some problem with the distutils sig -- my mail bounced with a mailman error. Anyway if you have any suggestions I'd love to hear them. If you want, I'll summarize your response to the distutils sig later when the mailinglist is fixed.

Odd. I'll try cc'ing the list and see what happens. I did notice http connections to python.org were appallingly slow yesterday -- and I still work in the same building (same LAN, modulo firewalls and so forth) as that machine!

-----Original Message----- From: Amos Latteier Sent: Friday, August 04, 2000 2:17 PM To: 'distutils-sig@python.org' Subject: Extracting meta-data from distributions

I've been thinking about how to query distutils packages. One thing I'd like to do is download archives from the net and programmatically find meta-data about the archive.

$ ./setup.py --help [...] Information display options (just display information, ignore any commands) --help-commands list all available commands --name print package name --version (-V) print package version --fullname print <package name>-<version> --author print the author's name --author-email print the author's email address --maintainer print the maintainer's name --maintainer-email print the maintainer's email address --contact print the maintainer's name if known, else the author's --contact-email print the maintainer's email address if known, else the author's --url print the URL for this package --licence print the licence of the package --license alias for --licence --description print the package description --long-description print the long package description [...] $ ./setup.py --name --version --author-email --url Distutils 0.9.1pre gward@python.net http://www.python.org/sigs/distutils-sig/ Clear enough?

* It seems that I must execute potentially untrusted code to get the meta-data. Is there anyway around this? I guess RExec is the answer...

Curses. I knew someone would get paranoid about writing dist-bots at some point. I have no answers to this... however, the above "informational" command shouldn't be doing any filesystem access apart from importing stuff, so it's probably "securable". Obviously, general Distutils usage makes extensive use of the filesystem, so writing general dist-bots securely will probably be tricky. Sigh.

* It seems that there is no distutils command to return all the meta-data that I can poke into sys.argv before importing setup.py. Should I replace distutils.core.setup with my own function before importing the archive's setup.py. Or is there a less hackish way to get back the meta-data all in one piece?

There's no "give me all meta-data" option -- you have to "just know" the options listed in the --help command. Also, obviously, the output assumes you "just know" the order of options as you supplied them on the command line. Oh well, it's a heck of a lot better than nothing.

Perhaps there are other better strategies for getting at distutils archive meta-data, since I'm pretty sure that this scenario has been already thought through by someone smart.

*blush* Actually, I can only take credit for knowing a good idea when I see it (the meta-data display options were Bastian Kleineidam's idea), and for tearing the command-line parsing code to shreds in order to allow the above semantics, where multiple options can be used together and their order is preserved. Greg -- Greg Ward - just another /P(erl|ython)/ hacker gward@python.net http://starship.python.net/~gward/ I invented skydiving in 1989!