Subject: [alpine-devel] Python Dependency Check Annoyance

From: "Jean-Louis Fuchs" <[email-masked]>
Date: Sat, 15 Sep 2018 15:54:44 +0200

Hi

Noticed that certbot on 3.8. does not run:

Traceback (most recent call last):
  File "/usr/bin/certbot", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 3086, in <module>
    @_call_aside
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 3070, in _call_aside
    f(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 3099, in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 576, in _build_master
    return cls._build_from_requirements(__requires__)
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 589, in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 783, in resolve
    raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (idna 2.7 (/usr/lib/python2.7/site-packages), Requirement.parse('idna<2.7,>=2.5'), set(['requests']))

Then I wanted to implement a test in certbot to check for this problem. but it is not possible, because actually idna, requets and certbot just work fine. The only thing that fails is this _build_from_requirements() in the certbox shim generated by setuptools (or whatever is doing it). So the error can only be detected once the package is installed. Since requests has started to lock-down their dependencies more strict and  everybody is using requests, I encounter this problem more often.

This post is not about how to fix dependencies (usually there is a workaround be upgrading or downgrading this or that package): I want to find out how to detect this early.

I actually often wished I had the pkgdir during check. But that seems like a bad idea too.

Best,
  Jean-Louis

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---