allow downloading yanked sdists for pip dependencies #506
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This is just a small update on @ben-alkov recent pull request. It was "hidden" deep in the backlog. |
|
The original story is a little weird, because I have definitely seen pip refuse to install anything at all if the only matching download has been yanked. It's possible that the deps in question weren't pinned, though (e.g. '==' or '==='), which seems to be prereq according to the applicable PEP. |
ben-alkov
reviewed
Mar 22, 2024
|
@slimreaper35; Overall, LGTM, but I feel like we should have a little more warning info for end-users. |
ben-alkov
reviewed
Mar 22, 2024
ben-alkov
approved these changes
Mar 22, 2024
ben-alkov
requested review from
brunoapimentel,
eskultety,
taylormadore and
ejegrova
taylormadore
approved these changes
Apr 2, 2024
Yes |
4 tasks
eskultety
approved these changes
Apr 3, 2024
cachi2 requires all dependencies to be pinned to a specific version A couple of notes from PEP 592: - "Yanking a file allows authors to effectively delete a file, without breaking things for people who have pinned to exactly a specific version" - "Yanked files are always ignored, unless they are the only file that matches a version specifier that 'pins' to an exact version" - "Regardless of the specific strategy that an installer chooses for deciding when to install yanked files, an installer SHOULD emit a warning when it does decide to install a yanked file" Signed-off-by: Michal Šoltis <msoltis@redhat.com>
Merged
via the queue into
containerbuildsystem:main
with commit Apr 9, 2024
67ca8c3
15 checks passed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Maintainers will complete the following section
Note: if the contribution is external (not from an organization member), the CI
pipeline will not run automatically. After verifying that the CI is safe to run:
/ok-to-test(as is the standard for Pipelines as Code)