[Distutils] Deprecate and Block requires/provides

[Nick Coghlan]

On 17 Oct 2013 13:02, "Donald Stufft" <donald at stufft.io> wrote:
>
> As many are aware distutils has the "requires" field and such. These
> fields are designed to list something you *import* not something you
> install from PyPI. I believe these fields to be generally useless,
supported
> by the fact distutils2 deprecated them, and outright user hostile. Users
> do not tend to realize that these aren't PyPI distributions and attempt to
> use them for that case. This generally "works" in that it will show up on
> PyPI but it will fail as soon as a distribution contains a character like
-.
>
> So what I would like to do is "remove" these fields. This would consist
> of modifying PyPI to return an error code if they are included and hiding
> the existing data in the UX. It might at a future time also consist of
removing
> the data from the DB all together.
>
> What do people think?

Don't break things when they don't pose an immediate security threat (and
sometimes not even then) :)

For this case, I like the idea of adding a note on projects where these
fields are displayed saying something like "These metadata fields are
obsolete and ignored by installation tools. Use setuptools metadata to
declare dependencies on other PyPI projects." (with an appropriate
hyperlink from "setuptools metadata").

And then maybe another caremad page listing projects that still use the
obsolete fields :)

Cheers,
Nick.

>
> -----------------
> Donald Stufft
> PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372
DCFA
>
>
> _______________________________________________
> Distutils-SIG maillist  -  Distutils-SIG at python.org
> https://mail.python.org/mailman/listinfo/distutils-sig
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20131017/3eab8be2/attachment.html>