[Distutils] setuptools: package management and explicit version numbers

[Phillip J. Eby]

At 12:02 PM 8/12/2005 +0100, Paul Moore wrote:
>OK, I retract the suggestion that no download be the default, but I'd
>still like a "manual download" option, which doesn't grab stuff
>automatically.

I can't really do this for ez_setup (which doesn't have access to command 
line parameters or distutils config settings), but it should be possible 
for easy_install.  I could maybe have a --local-only option that refuses to 
do downloads from any URL other than file: URLs.  However, for it to take 
effect when you're running another package's "setup.py install", you'd need 
to set it in your per-user or sitewide distutils config file, because it 
won't be usable on the command line.


>  After all, ez_setup has the option to go to a local
>cache (I can't recall how it works, but I know you mentioned it
>before).

--find-links=/some/directory

But that's an easy_install option, not an ez_setup option.  ez_setup is all 
about downloading setuptools itself, and the only "local caches" it 
recognizes are the current directory, and an installed egg on sys.path.

So really, your vetting process for installing a package would be to read 
its setup script to see what version of setuptools it uses, so you can 
download and install the setuptools egg before proceeding.  You can also 
read the setup script to find out what dependencies the package has, 
keeping in mind of course that any package that uses entry points, 
require(), etc. is not going to be happy if you install its dependencies in 
non-egg form.