BUG: incorrect version number generated in distributions

[xypron]

Debian and Ubuntu user package versions like 8.6.0-ds1 which are fine for *.deb packages but not legal according to PEP440.

In cheroot/init.py:13: the Debian package number is misused as Python package version.

 __version__ = pkg_resources.get_distribution('cheroot').version

This leads to errors like the following

$ python3
>>> import cheroot
>>> print cheroot.__version__
8.6.0+ds1
>>> from distutils.version import StrictVersion
>>> StrictVersion(cheroot.__version__)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/distutils/version.py", line 40, in __init__
    self.parse(vstring)
  File "/usr/lib/python3.10/distutils/version.py", line 137, in parse
    raise ValueError("invalid version number '%s'" % vstring)
ValueError: invalid version number '8.6.0+ds1'
>>>

It would be preferable to sanitize the string returned by pkg_resources.get_distribution('cheroot').version.

Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010894
Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1967139

Best regards

Heinrich

[webknjaz]

but not legal according to PEP440.

This is a misconception. Look into PEP 440, find a "local version" there and you'll see that it's perfectly fine to have it. Moreover, the specific use-case is for downstream packagers to encode their patches like that, or for SCM metadata to be appended. In our case, we rely on setuptools-scm to generate intermediate version numbers which also adds a Git commit sha in some cases.
One exception is that PyPI does not allow packages with such versions to be uploaded but that's about it.

This leads to errors like the following

This is because you used a StrictVersion from the deprecated distutils which only covers a sub-case and doesn't account for all of the things PEP 440 allows. As mentioned in #507 (review), today using the packaging dist is a preferred way of constructing a version object.

Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1967139

Looking at this, I can say that the bug is not ours. The proper upstream to report it to is Ceph:

   File "/usr/share/ceph/mgr/dashboard/cherrypy_backports.py", line 124, in accept_socket_error_0