Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adopt build because running setup.py is deprecated for security reasons #862

Open
cclauss opened this issue Aug 29, 2023 · 0 comments
Open

Comments

@cclauss
Copy link
Contributor

cclauss commented Aug 29, 2023

https://setuptools.pypa.io/en/latest/userguide/quickstart.html#setup-py

To avoid executing arbitrary scripts and boilerplate code, we are transitioning into a full-fledged setup.cfg to declare your package information instead of running setup().

See warning at https://setuptools.pypa.io/en/latest/deprecated/commands.html

running python setup.py directly as a script is considered deprecated. This also means that users should avoid running commands directly via python setup.py <command>.

% git grep setup\\.py

.github/workflows/python-publish.yml:      run: python setup.py build
.github/workflows/python-publish.yml:      run: python setup.py sdist bdist_wheel
CHANGELOG.rst:* Several minors updates to setup.py and tox
docs/release_process.rst:they lock the oauthlib version in ``setup.py`` and release anyway.
tox.ini:# as of today, RTD is using python3.7 and doesn't run "setup.py install"

https://pypa-build.readthedocs.io

Also, use https://pypi.org/project/setuptools-py2cfg to eliminate or greatly reduce setup.py. This could be a step towards using https://pypi.org/project/pyproject-migrator to get to replace setup.* with a pyproject.toml file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant