Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade bundled pip to 22.1 series #92688

Closed
pradyunsg opened this issue May 11, 2022 · 6 comments
Closed

Upgrade bundled pip to 22.1 series #92688

pradyunsg opened this issue May 11, 2022 · 6 comments
Labels
3.11 only security fixes stdlib Python modules in the Lib dir

Comments

@pradyunsg
Copy link
Member

pradyunsg commented May 11, 2022

This is in the same vein as #91141. There has been a new pip release, and ensurepip's bundled wheels should be updated to the newer version of pip.

@pradyunsg
Copy link
Member Author

pradyunsg commented May 11, 2022

Notably, due to pypa/pip#11044, Python 3.11+ can have a slightly different behaviour starting with pip 22.1 (it uses importlib.metadata instead of distutils/pkg_resources for loading metadata of installed packages).

@illia-v
Copy link
Contributor

illia-v commented Jun 4, 2022

It will be nice if #31885 is merged before the upgrade to have a checksum of the pip wheel verified.

@stefanor
Copy link
Contributor

FWIW, the 22.1 series doesn't work for ensurepip, yet (pypa/pip#11183)

@uranusjr
Copy link
Contributor

uranusjr commented Jun 12, 2022

There are a lot of layers compounding to the ultimate issue:

  1. pkg_resources unconditionally ignores any metadata inside a sys.path item with suffix .whl. This ignore clause was originally intended for PKG-INFO metadata (according to in-code comments), but also got applied to .dist-info metadata without careful scrutiny.
  2. importlib.metadata does not inherit this quirk.
  3. ensurepip populates pip by running pip inside the wheel, a use case not supported by pip maintainers.
  4. pip accidentally relied on the pkg_resources quirk to exclude itself from the installed packages, making installation process work.

So there are at least three ways we can fix this. But since running pip inside a wheel is not supported in the first place, I suggest changing ensurepip to not ship valid wheels, or pre-process them before running pip (matching how get-pip.py does this), which should resolve the issue. This also prevents people from getting a wrong idea from the stdlib, that pip actively supports being run inside a wheel.

@pradyunsg pradyunsg added stdlib Python modules in the Lib dir 3.11 only security fixes labels Jun 12, 2022
@sbidoul
Copy link
Contributor

sbidoul commented Jul 24, 2022

22.2 is compatible with ensurepip (pypa/pip#11217).
So I filed #95194 and this issue can be closed.

@kumaraditya303
Copy link
Contributor

Superseded by #95194

@kumaraditya303 kumaraditya303 closed this as not planned Won't fix, can't repro, duplicate, stale Jul 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.11 only security fixes stdlib Python modules in the Lib dir
Projects
None yet
Development

No branches or pull requests

6 participants