Pypi installation of 0.8 - Packages installed from PyPI cannot depend on packages which are not also hosted on PyPI.

[oligatorr]

Hello Giuseppe (@peppelinux),

I hope you are doing well.

I have been giving a try to installing the pymdoccbor lib from pypi and got the error below:

(.venv) olivier@MACFVFGL0K5Q05P LSPAttestationGeneration %  pip install pymdoccbor   
Collecting pymdoccbor
  Using cached pymdoccbor-0.8.0.tar.gz (47 kB)
  Preparing metadata (setup.py) ... done
ERROR: Packages installed from PyPI cannot depend on packages which are not also hosted on PyPI.
pymdoccbor depends on pycose@ git+https://github.com/devisefutures/pycose.git@hsm 

I believe it comes from the following lines in setup.py:42-43:

 #'pycose>=1.0.1,<1.1.0'
 "pycose @ git+https://github.com/devisefutures/pycose.git@hsm",

Is there still a reason not to rely on pycose directly ?

Thank you

Olivier

[peppelinux]

please note that pymdoccbor is now aligned with the fork of the EC (reference implementation)

This ref impl has unfortunately introduced a pycose fork, implementing cryptographic material from HSMs. This pycose fork is not released on pypi, creating a boring inconsistency in the package management

you can install the "devidesefuse" fork by hand or still use pycose without hsm support (main distribution) using the option ignore dependencies in your pip/poetry/other-pkg-mngt

[peppelinux]

Luis told me that His pycose fork was an experimentation of more than a year and and half ago and his team decided not to continue that way.

The code ended being left over in his branch but it shouldn't have ended up in the eudiw repository.

Especially in the setup.py since it will cause issues for anyone trying to use it.

I recommend to remove this legacy code and put the setup back to pycose 1.0.1 < pycose 1.1.0

@oligatorr could you please offer a pr for this project tò facilitate the resolution of this issue?

[oligatorr]

Hello @peppelinux

I can have a look and assess impacts to depend on pycose (and not a fork).

[oligatorr]

@peppelinux
Here is a very simple proposal #15
Hope this helps !

[oligatorr]

Hi @peppelinux
What are the next steps ? Do you plan to run python-publish.yml to upload this version onto PyPi ?

[oligatorr]

Looks like version 0.9 is available on pypi for me this issue can be closed.