can't pip install RBTools - no packages on pypi?

[Jason Antman]

I'm aware that pip is not a supported installation method for ReviewBoard itself. However, I have a number of cases where pip installation is the only method I can do, and I only need access to RBTools for the API client.

As of a few months ago, I was able to `pip install RBTools==0.5.2` without a problem, and I have this in a number of requirements.txt files.

This morning I tried re-deploying one of the applications that uses this, and got an error from pip saying "No distributions at all found" - there don't seem to be any valid packages on pypi itself, and even having it allow external URLs doesn't seem to work.

Is this an intentional change in behavior?

Thanks,
Jason

[Christian Hammond]

Hi Jason,

For I suppose security reasons, the pip team decided to no longer support installing packages that aren't hosted directly on PyPI. Since we actually host the packages ourselves (for a variety of reasons), pip will just ignore them.

There's a command line option in pip to turn this off, but we have no control over it ourselves.

It's possible you'll hit other issues with pip. I'm open to hearing about them, but we cannot offer official support for pip until they stop breaking us.

Christian

--
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

--
Get the Review Board Power Pack at http://www.reviewboard.org/powerpack/
---
Sign up for Review Board hosting at RBCommons: https://rbcommons.com/
---
Happy user? Let us know at http://www.reviewboard.org/users/
---
You received this message because you are subscribed to the Google Groups "reviewboard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to reviewboard...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Edward Delaporte]

For what it's worth, there seems to be a combination of command line flags that works as a workaround:

pip install rbtools --allow-external rbtools --allow-unverified rbtools

[David Trowbridge]

That will install the package, but I believe pip still doesn't properly register python entry points, which means that rbt won't work right.

-David

--

[Buck Golemon]

For the record, the below command does result in a correctly-working rbt command.

rbtools really should become compatible with the pip default options.

[kswe...@twitter.com]

Apologies if this is already answered somewhere in history, but are there any plans to revisit this change?

We (Apache Aurora) use rbt in our development workflow via pip to no apparent ill effect. We'd like to avoid the use of --allow-unverified RBTools

The currently-published version is only available via HTTP on a server external to PyPI. That means it's vulnerable to MITMs and it doesn't benefit from PyPI's caching infrastructure.

Thanks,

Kevin

[Christian Hammond]

Hi Kevin,

There's been some ongoing discussions about changes to pip and the strategy for verification/external packages. We're waiting to see how those impact us. In the meantime, we've made some of the changes needed to get us closer to not needing allow-unverified, but we're not fully there yet.

There's no plan to move everything onto PyPI's hosting. It shouldn't matter down the road, from my understanding, but it does depend on the future plans for pip/PyPI.

Christian

--

[kswe...@twitter.com]

Hi Christian,

Has there been any progress on these plans? Is there an issue I can watch?

Thanks,

Kevin

To unsubscribe from this group and stop receiving emails from it, send an email to reviewboard+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Christian Hammond]

Hi Kevin,

The next releases of RBTools and Review Board will ship Wheels, which are pip-compatible. We have everything in place for this already.

We've also moved to a better scheme for verified URLs, meaning that pip won't need the `--allow-unverified` stuff anymore. Every single download URL and file checksum is now registered with PyPI, so that clients can download the package and be absolutely sure the contents are what they should be.

What we're still missing is the support for registered external indexes, which pip and PyPI don't yet have. So, it'll still be necessary to do `--allow-all-external`. As soon as they introduce compatibility for PEP 470, we'll be able to implement that last bit, finally giving everyone the ability to do a simple 'pip install RBTools'.

We don't have any issue in our tracker for this, but we're waiting for this particular issue: https://github.com/pypa/warehouse/issues/431

Christian

--
Christian Hammond - chri...@beanbaginc.com
Review Board - https://www.reviewboard.org
Beanbag, Inc. - https://www.beanbaginc.com

[Dunnigan, Terrence J]

Great news!

What about Review Board Power Pack? Will this resolve the issue (for some of us) of obtaining the correct imaging libraries?

Terry

--
Supercharge your Review Board with Power Pack: https://www.reviewboard.org/powerpack/
Want us to host Review Board for you? Check out RBCommons: https://rbcommons.com/ Happy user? Let us know! https://www.reviewboard.org/users/

[Christian Hammond]

If the Pillow wheels contain support for all the image formats, and those get pulled in automatically through pip, then yes. Otherwise, the situation would be the same as it is today. We don't have really any control of how that's built, which is difficult. 
Unfortunately, none of the packaging stuff we're doing will affect the image libraries.

Basically, if 'easy_install Pillow' doesn't do the right thing, but 'pip install Pillow' does, then it should work.