Subject: Re: Avoiding ‘propagated-inputs’ for Python dependencies

From: Hartmut Goebel <[email-masked]>
Date: Sat, 17 Jun 2017 10:40:51 +0200

Am 10.06.2017 um 15:39 schrieb Ludovic Courtès:
>> > I asked Hartmut about this during the python-build-system refactoring,
>> > and the counter-argument was that if package A and B depends on
>> > different versions of package C, odd failures could occur. I'm not
>> > convinced propagation sidesteps this problem, however:
>> >
>> > https://lists.gnu.org/archive/html/guix-devel/2016-10/msg00856.html
> I think we’re in trouble anyway if multiple versions of a package end up
> in the dependency graph because that’s not something Python supports
> (the same is probably true for most languages, with the notable
> exception of Node.)

That's true, you will have trouble anyway.

But when adding the paths via .pth file, we will get more problems and –
even more important – these problems will not be reported. Obscure bugs
will the the result.

The Zen of Python [1] says:

Errors should never pass silently.

When using .pth-files, we will get a ot of silent errors.

Analysis
--------------

1. Paths searched for .pth files are processed in the order of sys.path
(PYTHONPATH)
2. Within each path, .pth files are processed alphabetically (see
site.addsitedir())
3. Within the .pth file, paths are processed in top-down order.

Let's assume, we add a file ".package-name.pth" to each package.

Now if a user installs packages AAA in his/her profile, AAA's
dependencies will be listed in ".AAA.pth". AAA depends on SOME-PACKAGE,
which at the time of AAA's installation is @>=1.0. Some time later, he
user installs package BBB, which requires SOME-PACKAGE @>=1.3.(being
backward-compatible with 1.0).

Since from guix's point of view AAA and BBB are not interfering, both
packages are installed fine. No warnings will be reported.

But BBB is bound to fail! .AAA.pth is always processed prior to
.BBB.pth, so SOME-PACKAGE will always be @1.0 - which is to old for BBB.

[1] https://www.python.org/dev/peps/pep-0020/

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | [email-masked]               |
| www.crazy-compilers.com | compilers which you thought are impossible |