[Python-Dev] PEP 365 (Adding the pkg_resources module)

[Phillip J. Eby]

At 01:59 PM 3/17/2008 -0500, Guido van Rossum wrote:
>I have certainly personally encountered plenty of situations where I
>wasn't able to complete an egg-based install because some dependency
>was broken (e.g. not available for the Python version I was using).

That's odd -- setuptools-based installs should be able to find and 
install packages from source.  I have noticed a recent phenomenon 
where new developers upload *only* an egg to PyPI, without the 
source, but that's usually short-lived until someone points it out to 
them.  Do you happen to know what packages you had this problem with?


>I'm okay if setuptools, once it's been installed, runs some setup code
>that creates the .egg-info directory and whatever else. This means I'm
>also okay with the bootstrap module finding and invoking that setup
>code. But I'm *not* okay with building any kind of egg management into
>the bootstrap module. The bootstrap module must be be neutral w.r.t.
>the package management style.

Ok, well then we'll have to invent a new kind of binary package, 
whose name isn't 'egg'.  Supporting distutils source packages is 
almost certainly a non-starter, if you want to avoid bringing the 
rest of setuptools into play.

The only way to correctly determine what a source package contains is 
to run its setup script...  and running unboxed setup scripts isn't 
safe because there are people who hardcode paths (or more precisely, 
use bad ways of computing them) in their setup scripts.

I'm not saying the tool needs to guard against *malicious* scripts, 
just badly-written ones.  (Setuptools does this with its "sandboxing" 
module, when running source packages' setup scripts.)

So, if source is out, then some binary format is needed, which means 
defining the conventions for said format...  i.e. "eggs lite" or "egg 
substitutes".  :)


> >  So, it might be simpler all around to just clear up the
> >  "controversy".  To the best of my recollection, only MAL and MvL have
> >  ever objected on Python-Dev to the idea of supporting eggs.
>
>You can add my name to the list. I've heard plenty of people speak
>highly of eggs, but I've *also* heard from plenty of people (besides
>MAL and MvL) who have serious difficulties with the concept of eggs.

I did say "on Python-Dev", and you implied that it was not 
controversial with you, except for the maintenance-related 
concerns.  I'm not fighting about this, but I would rather you were 
straight-up with your objections rather than deferring it to a 
controversy that "might go away in a few years".  That way, I could 
at least attempt to do something about the concerns.  OTOH, if your 
objections were non-specific and likely to stay that way, then I 
could have at least not wasted your time with any of this.