[Distutils] Dependency extensions

[Tres Seaver]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have use cases for a couple of extensions to how requirements are
spelled in a setuptools-enabled project.

Overriding Requirements
- -----------------------

I would like to be able to require package 'bar', but override one or
more of its dependencies (typically, 'bar' has over-strict version
qualifiers, which I need to relax).

I can imagine spelling such an override by including the overridden
project with a qualifier, e.g.: in foo/setup.py:

   install_requires=['bar',
                     '!baz==1.3', #override bar's spec of 1.2.4
                    ]

The "bang" here is borrowed loosely from CSS;  other spellings might be
clearer.

Another spelling might be to pass 'nodeps' or something as a suffix to
the overly-strict package, e,g,::

   install_requires=['bar (nodeps=baz)',
                     'baz==1.3',
                    ]


In general, I think the principal that the "most dependent" package wins
would be a reasonable policy, although not backward compatible at this
point.


Pinning Download Pages
- ----------------------

I would like to be able to "pin" a given package to a particular index /
download page, rather than searching the standard locations.

I could imagine either supplying the "pinned" find_url as a suffix, e.g.:

   install_requires=['baz (http://example.com/download-baz-here/)',
                    ]

Or else supplying a mapping which is used for the pinned URLs::

   install_requires=['baz'],
   pinned_urls={'baz': 'http://example.com/download-baz-here'}

The second might be easier to implement, but feels clunkier.

Thoughts?


Tres.
- --
===================================================================
Tres Seaver          +1 540-429-0999          tseaver at palladion.com
Palladion Software   "Excellence by Design"    http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHDoKC+gerLs4ltQ4RAqR0AJ99D44ob2Od0WecAW05E+MGcDruOgCgo7zV
q7XZxbyhFeh9engIsX0p/Rs=
=9bFP
-----END PGP SIGNATURE-----