pip: Package names containing a dot don't work under DevPI

@pfmoore well, imho that bugfix should have been a major release (from my pov its a breaking change of interaction with external systems)

devpi fix is out, see https://groups.google.com/d/msg/devpi-dev/-MgysUfZ36Q/JnqqMscrAAAJ

I’m going to close this issue since DevPI is fixed and there’s nothing actionable here on pip’s end. Thanks all!

@pfmoore im aware that the code change is small, but the behavior change is breaking

as such my opinion is, that a major release might have been better so people notice that the update might break something

as for devpi, i don’t know if the change on the server side is breaking or just cosmetic basally if it breaks users, major, if it doesn’t patch

To be clear it was warning since pip 6.0 in the general case, it was an oversight that it wasn’t correctly converting a . to a - (but it was converting other characters) and pip 8.0 was when that behavior was actually converted from a warning to an error (again, still with the oversight that . wasn’t getting converted to -) and it wasn’t until 8.1.2 that we happened to inadvertently correct that oversight because one of the libraries we use did it correctly.

Unfortunately we don’t have any metrics into how people are invoking pip, what the outcomes of their commands are, or anything like that which we could use to judge impact (if we had even realized this wasn’t working correctly in the first place or that we had inadvertently fixed it) so impact tends to be judged based on gut feeling mostly and testing against PyPI itself. Prior to PEP 503 the definition of what a repository was, was literally “whatever PyPI does” so all the non PyPI implementations attempted to copy that to varying degrees of success and typically they didn’t re-evaluate that when PyPI changed until pip install <thing> actually breaks for them.

Typically I would roll this back and issue a 8.1.3 and send this specific change through some kind of deprecation process… however, the dependency we updated and the changes that caused it to actually happen are fixing other important bugs caused by the new marker support. Rolling that back will re-break some packages that are currently not able to be installed by pip 8 -> 8.1.1. It ends up being a choice between breaking those packages, or breaking things like devpi and bandersnatch, and I have to fall along the axis of fixing the things we meant to fix in 8.1.2 and letting the breaking change stay, largely because those packages don’t have much of a recourse for fixing it otherwise and this breaking change can be fixed in devpi/bandersnatch/etc instead.

@chadawagner thank you!

pip 8.1.1 doesn’t have this problem.

@dstufft - sadly, no one except the few dedicated souls like your good self actually read, let alone understand PEPs (for this one you’d have had to be on the pypa lists (distutils-sig, still?) or maybe python-dev? to even find out about the PEP - is that a realistic expectation for everyone who runs any python package hosting infrastructure?).

The rest of us react to stuff changing as we find out about it, most often when things break.

What makes me sad is that this change means you can no longer host a poor man’s python package repository using a filesystem and apache, unless you can guarantee no packages include dots in their names…

@fschulze thanks for the quick fix 😃

See also, Postel’s Tarpit.

@pfmoore my understanding is that the intent was to change behavior in pip 8 and the fix life-cycle accidentally deferred that to 8.1.2

i’d prefer to only see that kind of change for major version jumps (as the intent was)

i’m well aware the current problem is unintended and i’m pretty sure i’d have done the release just as @dstufft did

this is more of a “ouch this is an accident, it should be major due to breakage we observe”

For anyone using tox on Travis CI, which creates a virtualenv and installs the latest pip (even though Travis CI environment itself uses pip 6.0.7, here’s how we worked around this problem.

Add a pip.sh script to your project:

#!/bin/bash
pip install '<8.1.2'
pip install "$@"

Add to your tox.ini:

install_command = {toxinidir}/pip.sh {opts} {packages}

This will downgrade the version of pip inside the virtualenv created by tox, before installing the dependencies.