Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-38488: Upgrade bundled versions of pip & setuptools #20491

Merged
merged 2 commits into from
Jun 15, 2020
Merged

bpo-38488: Upgrade bundled versions of pip & setuptools #20491

merged 2 commits into from
Jun 15, 2020

Conversation

xavfernandez
Copy link
Contributor

@xavfernandez xavfernandez commented May 28, 2020 •
edited by bedevere-bot
Loading

@xavfernandez xavfernandez mentioned this pull request May 28, 2020
Merged
@vstinner
Copy link
Member

For core devs reviewing this change: before merging a new setuptoos + pip upgrade, please run buildbots on the PR to ensure that it doesn't break FreeBSD and Install buildbots again. See https://bugs.python.org/issue38488 for the previous issues.

vstinner
vstinner requested changes May 28, 2020
View reviewed changes
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR doesn't seem to fix the 2 regressions that I listed in https://bugs.python.org/issue38488

@bedevere-bot
Copy link

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@vstinner
Copy link
Member

This PR doesn't seem to fix the 2 regressions that I listed in https://bugs.python.org/issue38488

Ah, the permission issue should be fixed: @xavfernandez wrote in #16782 (comment):

The permission issue is likely due to pypa/pip#8164 that was fixed in 20.1.1.
Sorry I did not keep this PR up-to-date with the latest pip, #20491 should hopefully fix this.

But what about the https://bugs.python.org/issue40808 issue?

@pradyunsg
Copy link
Member

pradyunsg commented May 28, 2020 •
edited
Loading

That looks like a fragile test that using re.sub to ignore that specific error message, but it's changed in the newer pip release.

@xavfernandez xavfernandez requested a review from vsajip as a code owner May 29, 2020 20:37
@xavfernandez
Copy link
Contributor Author

xavfernandez commented May 29, 2020 •
edited
Loading

But what about the https://bugs.python.org/issue40808 issue?

@vstinner , like Pradyun, this is due to pypa/pip@1ee270a that slightly changed the wording.

It should hopefully be fixed by 0a90c28

@vstinner vstinner added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 1, 2020
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @vstinner for commit 0a90c28 🤖

If you want to schedule another build, you need to add the ":hammer: test-with-buildbots" label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 1, 2020
@vstinner
Copy link
Member

vstinner commented Jun 1, 2020

Let's see how buildbots like this upgrade :-)

@xavfernandez
Copy link
Contributor Author

Buildbot seems happy ?

vstinner
vstinner approved these changes Jun 2, 2020
View reviewed changes
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. But I will not merge this PR since I don't know how to validate the content of binary wheel files.

Is there a GPG signature somewhere to verify the files? Or an automated way to validate its content?

@xavfernandez
Copy link
Contributor Author

Is there a GPG signature somewhere to verify the files? Or an automated way to validate its content?

No GPG signature but I'd suggest checking that the hashes of the bundled files match those advertised by https://pypi.org/project/pip/#files & https://pypi.org/project/setuptools/47.1.0/#files

@vstinner
Copy link
Member

vstinner commented Jun 2, 2020

I'd suggest checking that the hashes of the bundled files match those advertised by https://pypi.org/project/pip/#files & https://pypi.org/project/setuptools/47.1.0/#files

Would it be possible to add a tool somewhere in Tools/ to validate hashes of wheel binaries?

@ned-deily
Copy link
Member

I'd like to see this get into the next round of releases including 3.7.8 so I'm merging it now. I manually verified the hashes of the pip and setuptools wheels. Having a tool to manually check would be nice; even better, I think would be a tool that allows us to build the two wheels ourselves from source so that we are not dependent on non-source files from elsewhere.

@ned-deily ned-deily merged commit 5f79f46 into python:master Jun 15, 2020
@miss-islington
Copy link
Contributor

Thanks @xavfernandez for the PR, and @ned-deily for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Thanks @xavfernandez for the PR, and @ned-deily for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Thanks @xavfernandez for the PR, and @ned-deily for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Sorry, @xavfernandez and @ned-deily, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 5f79f46612c351bde78a41c5264c42db21008868 3.7

@miss-islington
Copy link
Contributor

Sorry @xavfernandez and @ned-deily, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 5f79f46612c351bde78a41c5264c42db21008868 3.8

@bedevere-bot bedevere-bot removed the needs backport to 3.9 only security fixes label Jun 15, 2020
@bedevere-bot
Copy link

GH-20898 is a backport of this pull request to the 3.9 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 15, 2020
@xavfernandez @miss-islington
bpo-38488: Upgrade bundled versions of pip & setuptools (pythonGH-20491)
d813e5d 
(cherry picked from commit 5f79f46)

Co-authored-by: Xavier Fernandez <[email protected]>
miss-islington added a commit that referenced this pull request Jun 15, 2020
@miss-islington @xavfernandez
bpo-38488: Upgrade bundled versions of pip & setuptools (GH-20491)
bc996c6 
(cherry picked from commit 5f79f46)

Co-authored-by: Xavier Fernandez <[email protected]>
ned-deily pushed a commit to ned-deily/cpython that referenced this pull request Jun 15, 2020
@xavfernandez @ned-deily
bpo-38488: Upgrade bundled versions of pip & setuptools (pythonGH-20491)
d53bb83
@bedevere-bot
Copy link

GH-20900 is a backport of this pull request to the 3.8 branch.

ned-deily added a commit that referenced this pull request Jun 15, 2020
@ned-deily @xavfernandez
bpo-38488: Upgrade bundled versions of pip & setuptools (GH-20491) (G…
e63cc2f 
…H-20900)

Co-authored-by: Xavier Fernandez <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 15, 2020
@ned-deily @miss-islington
bpo-38488: Upgrade bundled versions of pip & setuptools (pythonGH-20491…
da6426e 
…) (pythonGH-20900)

Co-authored-by: Xavier Fernandez <[email protected]>
(cherry picked from commit e63cc2f)

Co-authored-by: Ned Deily <[email protected]>
miss-islington added a commit that referenced this pull request Jun 15, 2020
@miss-islington @ned-deily
bpo-38488: Upgrade bundled versions of pip & setuptools (GH-20491) (G…
678ffc4 
…H-20900)

Co-authored-by: Xavier Fernandez <[email protected]>
(cherry picked from commit e63cc2f)

Co-authored-by: Ned Deily <[email protected]>
arun-mani-j pushed a commit to arun-mani-j/cpython that referenced this pull request Jul 21, 2020
@xavfernandez @arun-mani-j
bpo-38488: Upgrade bundled versions of pip & setuptools (pythonGH-20491)
4e21c52
@xavfernandez xavfernandez deleted the bump_pip_setuptools branch July 24, 2020 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vstinner vstinner vstinner approved these changes

@vsajip vsajip Awaiting requested review from vsajip

Assignees

@ned-deily ned-deily

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@xavfernandez @vstinner @bedevere-bot @pradyunsg @ned-deily @miss-islington @the-knights-who-say-ni