[Distutils] setuptools: Bug in requirement loading

[Ian Bicking]

This seems odd to me, but the requirement loading just seems all off in 
pkg_resources.  This is with 0.6a7.  In resolve() we have this code:


             req = requirements.pop(0)   # process dependencies breadth-firs
             if req in processed:
                 # Ignore cyclic or redundant dependencies
                 continue
             dist = best.get(req.key)
             if dist is None:
                 # Find the best distribution and add it to the map
                 dist = self.by_key.get(req.key)
                 if dist is None:
                     if env is None:
                         env = Environment(self.entries)
                     dist = best[req.key] = env.best_match(req, self, instal
                     if dist is None:
                         raise DistributionNotFound(req)  # XXX put more inf
                 to_activate.append(dist)
             elif dist not in req:
                 # Oops, the "best" so far conflicts with a dependency
                 raise VersionConflict(dist,req) # XXX put more info here
             requirements.extend(dist.requires(req.extras)[::-1])
             processed[req] = True

(got a little truncated, but ignoring that.)  If "dist is None", i.e., 
no egg for the requirement is yet loaded, the egg is loaded with 
"self.by_key.get(req.key)".  req.key doesn't have any version 
information, it's just the package name.  How does the proper version 
get loaded?  There's also no test that "dist in req" for that branch. 
So I'm currently doing "require('SQLObject>=0.8dev')" and getting back 
SQLObject 0.7b1, with no error.  0.7b1 is the default egg, which is why 
I guess it is in self.by_key.

setuptools 0.6a5 acted the same way, so it's not a (recent) regression.

If I change the second "if dist is None" to "if dist is None or dist not 
in req" then at least I get a version conflict.  But I thought 
setuptools 0.6a7 was able to load an egg besides the default version. 
Actually, I'm now confused how anything but the default version can be 
loaded.

I'm having a hard time figuring out how I didn't notice this before.

   Ian