Path: csiph.com!news.freedyn.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.szaf.org!feedme.news.telefonica.de!storethat.news.telefonica.de!telefonica.de!news.panservice.it!bofh.it!news.nic.it!robomod
From: Donald Stufft <donald@stufft.io>
Newsgroups: linux.debian.maint.python
Subject: Re: Amend Debian Python Proposal to Include More Python Metadata?
Date: Fri, 22 Jan 2016 18:00:04 +0100
Message-ID: <qTNe4-6HG-41@gated-at.bofh.it>
References: <qTopk-6qy-11@gated-at.bofh.it> <qTLYC-5Vz-11@gated-at.bofh.it> <qTMhZ-62g-15@gated-at.bofh.it> <qTMBj-6ri-9@gated-at.bofh.it>
Old-Return-Path: <donald@stufft.io>
Content-Type: multipart/signed; boundary="Apple-Mail=_643FCA93-5359-4106-98C2-2D39C60A1174"; protocol="application/pgp-signature"; micalg=pgp-sha512
MIME-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
Approved: robomod@news.nic.it
Lines: 97
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
Xref: csiph.com linux.debian.maint.python:8120


--Apple-Mail=_643FCA93-5359-4106-98C2-2D39C60A1174
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> On Jan 22, 2016, at 11:18 AM, Piotr O=C5=BCarowski <piotr@debian.org> =
wrote:
>=20
> let's make a deal. If you will make sure pip doesn't touch system =
files
> (and others will not crucify me for this) - I will make sure pybuild
> uses above line (if setuptools is not detected in setup.py but is =
listed
> in Build-Depends).

Regardless of what happens in this thread, pip is going to stop mucking =
around
in files that are owned by some other tool without some sort of =
opt-in/--force
style flag *and* we're going to be restructuring things to try and guide =
people
away from using pip outside of a virtual environment or through the user =
of
--user as well.

The main reason why that hasn't happened yet isn't because I'm holding =
those
things hostage, it's because I'm one person and my time is spread =
amongst
several really important tools and I have to prioritize things in =
accordance to
how bad it's on fire. In addition, pip is a cross platform program and =
we have
to ensure that whatever we do works in a cross platform manner. You =
mentioned
/usr/local/.../site-packages/ before, but plenty of systems don't have a
/usr/local/.../site-packages/ that their Python respects because that is =
a
Debian specific patch, so if we refused to install to =
/usr/.../site-packages/
we'd break installing at the system level on all platforms but Debian =
derived
ones.

What we need is a cross platform way to determine if a particular =
installed
Python package is "owned" by the system or if it's something we're =
allowed to
modify. That's going to require some effort to work out the exact best =
way,
but in my head the way forward on that is to use the metadata directory =
(the
one I'm asking y'all to start using) and add an additional piece of =
metadata
inside of it that just says "Hey, This is a system install" that we can =
inspect
and then take additional logic (like refusing to touch it without a =
--force)
based on that. The change I'm asking for here helps make that possible =
(among
other things).

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 =
DCFA


--Apple-Mail=_643FCA93-5359-4106-98C2-2D39C60A1174
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJWol7fAAoJEG48vOkzctz6wZMQAIvoyG2lOKGv2RgQyRkJYs2E
fyD25+fLILOFQDXwkFL82HPzOrqHJuYE/VXfTOjzwkzJsSfGDEFsPw5y0N44lyTP
ipqJdfk7bw1DuuRS60DUfR3XzmWnFkhRu/dJfxJUSMJ3UTOLSit/NyXIOI8UDts3
57eMMjVSyw/UdDwHd9b5JDoZTuGpVoSr21tNF5rarr8jsE8WVTalLI7evh7ZX8SX
BL+7S7W7aybRafbu+JO2jyBuLwqEB6d/q7j2Klon0YnyOcH7LyfhWput20w2gB84
yTgMjPDWh5R+QbfUd0xiAqXfVPqKDt9WUrM/bthc07bToxeYcDolg1c6x5Lbd18C
6S93IWWViQKIEKMUGZiYVDJj2PiFyDZKuvZWqOziaSIHmLXFQ9NCCVCIQaXXUaX0
8l4W/evRGagJ0c2n8SAmtguDNouyzmfJvSlk4IOJmZPWq4h48x8WthxF3w2H32EL
UoywDY3C2iv5Mx+gwYxKGXbaBiOauvO3STjWdN2S0frAaJk2UgdvXQ38ZmcRGMWr
BS6kWzxVFwsVim5poupGEKqwEe2P8dSbgmm3zrIlOUbh1RPokAl9OoqNt/wfZ+ir
1bv/t2JSJpprAu1i0TLtYXkcprzKUXztwOecQC1cdpOBu7YFIn7nemy8Q90RKu6z
/UHo+DWExWl9+6JlPPGW
=7vjq
-----END PGP SIGNATURE-----

--Apple-Mail=_643FCA93-5359-4106-98C2-2D39C60A1174--