python2.7: pkg_resources.ContextualVersionConflict: enum34 1.1.10

[recvfrom]

Description

Running python2.7 -mpip install -e . to install the capa source on Ubuntu 18.04 causes enum34 version 1.1.10 to be installed, but capa then fails to run and presents an exception noting that version enum34 version 1.1.6 is required.

Steps to Reproduce

1. cd to a checkout of capa
2. Run python2.7 -mpip install -e .
3. Run python2.7 ~/.local/bin/capa <exe path>

Expected behavior:

The program should be analyzed successfully

Actual behavior:

Traceback (most recent call last):
  File "/home/zelda/.local/bin/capa", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/home/zelda/.local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 3241, in <module>
    @_call_aside
  File "/home/zelda/.local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 3225, in _call_aside
    f(*args, **kwargs)
  File "/home/zelda/.local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 3254, in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/home/zelda/.local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 585, in _build_master
    return cls._build_from_requirements(__requires__)
  File "/home/zelda/.local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 598, in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/home/zelda/.local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 791, in resolve
    raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (enum34 1.1.10 (/home/zelda/.local/lib/python2.7/site-packages), Requirement.parse('enum34==1.1.6; python_version < "3.4"'), set(['log-symbols', 'spinners']))

Versions

master
Ubuntu 18.04

Additional Information

It looks like capa requires halo==0.0.30, which has a dependency on spinners>=0.0.24. spinners 0.0.24 gets installed on my machine, and it has a dependency on enum34==1.1.6.

Making the following change fixes it for me, and the EXE I was looking at went on to be analyzed successfully, but I haven't done extensive testing with this change in place:

--- a/setup.py
+++ b/setup.py
@@ -19,7 +19,7 @@ if sys.version_info >= (3, 0):
     requirements.append("networkx")
 else:
     # py2
-    requirements.append("enum34")
+    requirements.append("enum34==1.1.6")
     requirements.append("vivisect @ https://github.com/williballenthin/vivisect/tarball/v0.0.20200804#egg=vivisect")
     requirements.append("viv-utils")
     requirements.append("networkx==2.2")  # v2.2 is last version supported by Python 2.7

[williballenthin]

looks like a good fix to me. pinning all of our deps is probably the safest thing to do. this change will help get us there.

i'll merge this change as a PR if you'd like to propose it.