python-poetry / python-poetry/poetry

Cannot install `bleach`-package via git (detects vendorized package rather than main package)

Open
#5,070 1 comment 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

kind/bug status/triage
Dominant language
Python
Stars
34.3k
Forks
2.5k
Avg merge
2d 19h
Merged PRs (30d)
30

Description

  • I am on the latest Poetry version.
  • I have searched the issues of this repo and believe that this is not a duplicate.
  • If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

Issue

When installing the bleach-package (Github, PyPI) via git, Poetry identifies the package as having the name html5lib rather than the intended name bleach. This is as of bleach v4.1.0.

For example, if you do:

poetry init
poetry add -vvv 'git+https://github.com/mozilla/bleach.git#main'

You get a pyproject.toml with the following [tool.poetry.dependencies]-section (see also Gist linked above):

[tool.poetry.dependencies]
python = "^3.10"
html5lib = {git = "https://github.com/mozilla/bleach.git", rev = "main"}

here we see bleach incorrectly listed as html5lib.

If you try and change html5lib to bleach in pyproject.toml you get the following error:

The dependency name for bleach does not match the actual package's name: html5lib

All of this happens because the repository contains a vendored html5lib including the directory bleach/_vendor/html5lib-1.1dist-info. This directory is the first thing Poetry's src/poetry/inspection/info.py::from_metadata() (link) finds and thus it's used as the source of truth for information about the package (package name being part of that).

It's not clear to me that Poetry can solve this, since the way the package is vendored is a bit weird and AFAICT Poetry can only rely on heuristics for detecting package contents.

Anyhow, I ran into this issue and I thought I would post it here, if anyone else runs into something similar.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with poetry add -vvv 'git+https://github.com/mozilla/bleach.git#main' using the linked project configuration. Start in src/poetry/inspection/info.py, especially from_metadata() around the referenced lines, and investigate how the vendored html5lib-1.1dist-info is selected. Done means the git dependency is identified as bleach rather than html5lib.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.