Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Nick Coghlan
On 12 May 2014 15:39, Donald Stufft don...@stufft.io wrote: On May 12, 2014, at 12:50 AM, Nick Coghlan ncogh...@gmail.com wrote: There are some more notable names in the unsafe lists, but a few spot checks on projects like PyGObject, PyGTK, biopython, dbus-python, django-piston, ipaddr,

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Donald Stufft
On May 12, 2014, at 2:21 AM, Nick Coghlan ncogh...@gmail.com wrote: On 12 May 2014 15:39, Donald Stufft don...@stufft.io wrote: On May 12, 2014, at 12:50 AM, Nick Coghlan ncogh...@gmail.com wrote: There are some more notable names in the unsafe lists, but a few spot checks on projects like

[Distutils] Problem with latest buildout bootstrap on Windows with Python 3.3

2014-05-12 Thread Lele Gaifax
Hi all, I'm facing a problem trying to bootstrap a buildout with its latest bootstrap script under Windows, using Python 3.3. I'm looking for some hint to decide whether the issue is with buildout, Python 3, or with my own installation ... The problem is that executing the bootstrap script I

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread M.-A. Lemburg
On 09.05.2014 12:16, Paul Moore wrote: So there's an ongoing debate over pip's behaviour around disallowing external hosting by default (see thread pip: cdecimal an externally hosted file and may be unreliable over on python-dev for the latest round). It appears that the reason for

Re: [Distutils] PyPI down?

2014-05-12 Thread Wichert Akkerman
On 10 May 2014, at 21:10, Donald Stufft don...@stufft.io wrote: Hm, it’s working here. It works correctly now, but it was down for me at the time I send that mail about 13 hours ago. Can you tell me where about in the world you are? The Netherlands. For routing purposes: AS 3265. Wichert.

Re: [Distutils] Need for respect (was: PEP 438, pip and --allow-external)

2014-05-12 Thread M.-A. Lemburg
Given the thread on python-dev and comments I have read elsewhere, I would like to remind everyone in this discussion to come back to a respectful attitude towards the issues being discussed and the people involved. I am writing this as Python core developer and as PSF board member. PyPI is run

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread M.-A. Lemburg
On 11.05.2014 16:48, Paul Moore wrote: On 11 May 2014 13:47, Donald Stufft don...@stufft.io wrote: https://pypi.python.org/simple/egenix-mx-base/ has verifiable external links. I'm pretty surprised that Donald hasn't heard of mx-base. egenix-mx-base does not have verifiable external

Re: [Distutils] Need for respect (was: PEP 438, pip and --allow-external)

2014-05-12 Thread Nick Coghlan
On 12 May 2014 21:34, M.-A. Lemburg m...@egenix.com wrote: Think about it: PyPI has become a great hosting platform in the last year, it's attractive to host packages on the platform and this also shows in the number of package authors that have decided to switch over to PyPI for hosting.

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Daniel Holth
If this was apt-get or yum, there would be no concept of hosting apart from an index and you would have to run a command like apt-add-repository http://xyz.com; or place a file in /etc/... Then the extra repository + packages would become available. On Mon, May 12, 2014 at 8:28 AM, M.-A. Lemburg

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Paul Moore
On 12 May 2014 13:28, M.-A. Lemburg m...@egenix.com wrote: So, some questions: 1. Is MAL aware that egenix-mx-base is not verifiably externally hosted[1], and if so, what is he asking for? Automatic download with no need for opt-in of unverifiable external downloads? That seems pretty much

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Stefan Krah
Paul Moore p.f.mo...@gmail.com wrote: I'm not quite sure how you expect this will work, but it's probably important that you get involved with the various packaging PEPs. The only way I can see such a solution working with pip would be if you have a customised setup.py. As the general trend is

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread M.-A. Lemburg
On 12.05.2014 15:58, Paul Moore wrote: On 12 May 2014 13:28, M.-A. Lemburg m...@egenix.com wrote: So, some questions: 1. Is MAL aware that egenix-mx-base is not verifiably externally hosted[1], and if so, what is he asking for? Automatic download with no need for opt-in of unverifiable

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Donald Stufft
On May 12, 2014, at 3:58 PM, M.-A. Lemburg m...@egenix.com wrote: On 12.05.2014 15:58, Paul Moore wrote: On 12 May 2014 13:28, M.-A. Lemburg m...@egenix.com wrote: So, some questions: 1. Is MAL aware that egenix-mx-base is not verifiably externally hosted[1], and if so, what is he asking

Re: [Distutils] PEP 438, pip and --allow-external

2014-05-12 Thread M.-A. Lemburg
On 12.05.2014 22:31, Donald Stufft wrote: On May 12, 2014, at 3:58 PM, M.-A. Lemburg m...@egenix.com wrote: On 12.05.2014 15:58, Paul Moore wrote: On 12 May 2014 13:28, M.-A. Lemburg m...@egenix.com wrote: So, some questions: 1. Is MAL aware that egenix-mx-base is not verifiably

Re: [Distutils] PEP 438, pip and --allow-external

2014-05-12 Thread Donald Stufft
On May 12, 2014, at 4:33 PM, M.-A. Lemburg m...@egenix.com wrote: On 12.05.2014 22:31, Donald Stufft wrote: On May 12, 2014, at 3:58 PM, M.-A. Lemburg m...@egenix.com wrote: On 12.05.2014 15:58, Paul Moore wrote: On 12 May 2014 13:28, M.-A. Lemburg m...@egenix.com wrote: So, some

Re: [Distutils] PEP 438, pip and --allow-external

2014-05-12 Thread M.-A. Lemburg
On 12.05.2014 22:37, Donald Stufft wrote: On May 12, 2014, at 4:33 PM, M.-A. Lemburg m...@egenix.com wrote: Binary installs are nice, but they are not the answer to everything and no matter how much meta data you put into static files, there will always be cases where that meta data

Re: [Distutils] PEP 438, pip and --allow-external

2014-05-12 Thread Donald Stufft
On May 12, 2014, at 4:50 PM, M.-A. Lemburg m...@egenix.com wrote: On 12.05.2014 22:37, Donald Stufft wrote: On May 12, 2014, at 4:33 PM, M.-A. Lemburg m...@egenix.com wrote: Binary installs are nice, but they are not the answer to everything and no matter how much meta data you put into

Re: [Distutils] PEP 438, pip and --allow-external

2014-05-12 Thread Donald Stufft
On May 12, 2014, at 4:51 PM, Donald Stufft don...@stufft.io wrote: On May 12, 2014, at 4:50 PM, M.-A. Lemburg m...@egenix.com wrote: On 12.05.2014 22:37, Donald Stufft wrote: On May 12, 2014, at 4:33 PM, M.-A. Lemburg m...@egenix.com wrote: Binary installs are nice, but they are not

Re: [Distutils] Need for respect (was: PEP 438, pip and --allow-external)

2014-05-12 Thread Paul Moore
On 12 May 2014 16:57, Stefan Krah stefan-use...@bytereef.org wrote: Thank you for your measured responses, and I agree with you that pip should follow PEP 438. The main argument on python-dev was about *editorializing* the contents of the PEP in both pip warning messages and posts to the

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Paul Moore
On 12 May 2014 17:15, Stefan Krah stefan-use...@bytereef.org wrote: Paul Moore p.f.mo...@gmail.com wrote: I'm not quite sure how you expect this will work, but it's probably important that you get involved with the various packaging PEPs. The only way I can see such a solution working with pip

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Paul Moore
On 12 May 2014 20:58, M.-A. Lemburg m...@egenix.com wrote: If it helps convince you that allowing verifiable external links per default is a good thing for user experience, we will register the distribution file download URLs with the PyPI web API. Personally, I'm on the fence over that one.

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Paul Moore
On 12 May 2014 21:31, Donald Stufft don...@stufft.io wrote: This is slightly confusing but pip will always be able to go from an sdist to an installed system. It'll just build a Wheel first and then install the Wheel (at least that's the idea). This is a sort of vague idea right now but it's

Re: [Distutils] Metabuild hooks

2014-05-12 Thread Nick Coghlan
On 13 May 2014 08:03, Paul Moore p.f.mo...@gmail.com wrote: The current approach is to solve 90% of the problem by noting that nearly all projects don't take advantage of any of the (usually undocumented) flexibility that distutils allows. This has thus far been a great success, in terms of

Re: [Distutils] PEP 438, pip and --allow-external (was: pip: cdecimal an externally hosted file and may be unreliable from python-dev)

2014-05-12 Thread Vinay Sajip
The setup.py interface makes all this possible, which is why so many Python packages use it to configure themselves automatically. Deprecating this interface would make some distributions impossible to install without manual user intervention and we'd be back to the Makefile.pre.in days.