pypa / pypa/setuptools

requires keyword produces invalid METADATA when uses with 2.1 generating arguments

Open
#1,396 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug help wanted Needs Implementation Needs Investigation
Dominant language
Python
Stars
2.9k
Forks
1.4k
Avg merge
1d 1h
Merged PRs (30d)
1

Description

This bug has been found originally with dateutils:
https://github.com/dateutil/dateutil/issues/720

This generated bad metadata as per distlib: https://bitbucket.org/pypa/distlib/issues/106/support-21-metadata

easy reproducer:

# setup.py content in an empty folder
from setuptools import setup

setup(name="mytest_pkg",
      long_description='hello\n====\n',
      long_description_content_type='text/x-rst',
      requires=["six"],
      packages=[],
      )

then use humpty which leverage distlib to parse the metadata of the wheel:

pip wheel . && humpty mytest_pkg-0.0.0-py3-none-any.whl

generated metadata for this setup.py is:

Metadata-Version: 2.1
Name: mytest-pkg
Version: 0.0.0
Summary: UNKNOWN
Home-page: UNKNOWN
Author: UNKNOWN
Author-email: UNKNOWN
License: UNKNOWN
Platform: UNKNOWN
Requires: six

hello
====

as per Vinay Sajip comment:

Notice the line Requires: six. This does not (to his reading) conform to metadata 2.1, by my reading of PEP 566:

Fields are now specified via the Core Metadata Specification.
Added two new fields: Description-Content-Type and Provides-Extra
Note that the linked Core Metadata Specification makes no reference to a Requires field, which dates from a older metadata specification (1.1, defined in the superseded PEP 314). While distlib's interpretation - that the presence of this obsolete field disqualifies the metadata from being considered 2.1-compatible - might be considered by some as over-strict, one could also point to the Zen of Python: "In the face of ambiguity, refuse the temptation to guess."

This is related to #1374

setup.py should fail when using requires in addition from arguments that generates new metadata, so that it does not generates illegal metadata.
Not sure if there are other incompatible metadata

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the minimal setup.py reproducer using requires=["six"], then run pip wheel and inspect the generated wheel metadata with humpty. Compare the output with the PEP 566 metadata requirements and determine the expected handling of requires; done means the reproducer no longer produces invalid Metadata-Version 2.1 metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.