Subject: Compressed eggs (Python)

From: Hartmut Goebel <[email-masked]>
Date: Mon, 18 Apr 2016 21:21:19 +0200

Hi,

I support the proposal for switching to pip.

Switching to pip should be save, since this is the proposed standard way
for installing - and thus it should be save in the long run, too.

I suggest calling pip with this options (valid as of pip 8.1.1)

--no-deps                        Don't install package dependencies.
--no-binary :all:                Do not use binary packages.
--no-index                        Ignore package index
--disable-pip-version-check

Since in the internet one can find issues with
--single-version-externally-managed I verified that pip will even work
for packages using distutils instead of setuptools. I did a test and
inspecting the software.

Here is what I did: I used a simply Python package which imports
distutils instead of setuptools. Installing the via pip in verbose-mode
shows this line (you do not need to look at the details):

    Running command /tmp/myvenv/bin/python2.7 -u -c "import setuptools,
tokenize;__file__='/tmp/pip-Biwi3y-build/setup.py';exec(compile(getattr(tokenize,
'open', open)(__file__).read().replace('\r\n', '\n'), __file__,
'exec'))" install --record /tmp/pip-KcE_9O-record/install-record.txt
--single-version-externally-managed --compile --install-headers
/tmp/myvenv/include/site/python2.7/sample

This basically runs the setup.py “wrapped” into setuptools [1]. The
source code of setuptools reviled that it is monkey-pathing distutils
(esp. distutils.dist.Distribution) to objects from setuptools. So the
more elaborate stuff of setuptools is used even if the setup.py only
import distutils.

Additionally I checked what --single-version-externally-managed does
(since the documentation [2] is not that clear): it simply makes
`install` use the "original" distutils install command, which was/is not
able to create zipped eggs. So here we are on the save side, too.

Tested with pip 8.1.1 and setuptools 20.3, but this same code is in pip
6.0 and setuptools 18.0 already (which are older than what is in guix
0.10.0)

[1] Technically this line is executing a command which import setuptools
and then executes setup.py the it the same scope/context.
[2]
https://pythonhosted.org/setuptools/setuptools.html#install-run-easy-install-or-old-style-installation.

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | [email-masked]               |
| www.crazy-compilers.com | compilers which you thought are impossible |