Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Setuptools version 78.0.1 breaks install of many packages

github.com

Post reply on HN
Print view View original

11–14 of 14 posts

Re: Setuptools version 78.0.1 breaks install of many packages

#11

Post by jarboot »

Numerlor wrote: post #10
jarboot wrote: post #7

The current approach of the maintainers terrifies me -- de facto standards should be respected. Even if something is invalid like `description-file`, if it is present in 12k repos it should raise a warning and not break anything. In the rationale for this that I can find [1], a maintainer says the following: > I'm inclined to say we should do it, even though it will cause some disruption. They also say an alternative…

I'm usually of the opinion of just removing stuff when it needs to be gone, but this is really an incosequential change to the setuptools code compared to how many problems it caused

"Needs to be gone" is the operative phrase here. An alias of `description-long` to `description_long` has no specific technical need to be removed.

The conditions that lead to having two tokens pointing to the same functionality should be prevented, but in this case it is a "de facto" alias which no amount reasonable amount of labor could fix.

Re: Setuptools version 78.0.1 breaks install of many packages

#12

Post by HereBeBeasties »

jarboot wrote: post #7

The current approach of the maintainers terrifies me -- de facto standards should be respected. Even if something is invalid like `description-file`, if it is present in 12k repos it should raise a warning and not break anything. In the rationale for this that I can find [1], a maintainer says the following: > I'm inclined to say we should do it, even though it will cause some disruption. They also say an alternative…

It seems that the person who did this acted unilaterally, with no code review, and ignored (then disabled) broken tests while landing this (https://github.com/pypa/setuptools/pull/4909). One should not be too harsh - he seems to be a student. One perhaps should be more harsh on the commerical entity sponsoring the project, though - setuptools is sponsored by Sonar via "Tidelift". According to https://tidelift.com/subscription/pkg/pypi-setuptools:

> The maintainers of setuptools get paid by Tidelift to

> implement industry-leading secure software development

> practices and document the practices they follow.

Well, that really doesn't seem so in this case now, does it?

Re: Setuptools version 78.0.1 breaks install of many packages

#13

Post by shadowgovt »

brtkwr wrote: post #4

Probably 78.0.0 as well which was released yesterday. The diff between 78.0.0 and 78.0.1 appears to be no-op from user perspective https://github.com/pypa/setuptools/compare/v78.0.0...v78.0.1

A yank may not actually be warranted in this circumstance. The change works for most users of setuptools; it's only a very specific configuration of (build-environment, setuptools-version, third-party-dependency) that can cause an issue.

This is one of those situations where the scale of the software package is so large that even if only 0.1% of users had issue, that's a number representing tens of thousands of people.

Re: Setuptools version 78.0.1 breaks install of many packages

#14

Post by vanschelven »

lopuhin wrote: post #5

Crazy amount of breakage... Here is a PR which reverts this: https://github.com/pypa/setuptools/pull/4911 Interesting that maintainers of setuptools still only postpone the depreciation date for a year, so we can probably expect more issues like this in the future.

After thousands of comments, they're now reconsidering: https://github.com/pypa/setuptools/issues/4921
Post reply on HN