Python pip setup.cfg #562

adamchainz · 2020-05-25T21:06:56Z

I'm not sure this is exactly the right place to report, but it seems logical.

Python's packaging ecosystem has long used a setup.py file for package metadata. However, since 2016, it has been possible to place all the metadata instead in the setup.cfg file, avoiding the need for executable Python code. (docs).

Although metadata has been supported since 2016, it has seen slow adoption. For example, Django has moved to it recently in 3.1 (still in alpha): django/django@85efc14 .

It seems at the moment, semantic only attempts to parse metadata from setup.py files:

semantic/src/Semantic/Graph.hs

Line 331 in 46d8201

    
           strat <- case find (\b -> blobPath b == (projectRootDir project Path.</> Path.relFile "setup.py")) (projectBlobs project) of

This is where I'm not so sure if this is the origin for the actual observed issue. The problem I'm chasing is that GitHub security alerts don't propagate from source repos using setup.cfg for their metadata, only those using setup.py. I'm guessing this is because they're parsed with semantic.

As reported to me by @davidism, maintainer of some popular Python projects: django/asgiref#161 (comment)

The text was updated successfully, but these errors were encountered:

patrickt · 2020-05-25T21:29:59Z

We’re currently overhauling how Semantic.Graph works, so this code path will probably perish, but let’s keep this open to make sure we account for it during Python stack-graphing.

davidism · 2020-05-25T21:52:38Z

To add a bit more information, I need to leave a minimal setup.py with name and install_requires in order for GitHub's dependency graph feature to work. You can see this in the various Pallets projects, such as Flask: https://github.com/pallets/flask/blob/330a3e3ddba712def955e7a2ccee92a205dfb656/setup.py

setup(
    name="Flask",
    install_requires=[
        "Werkzeug>=0.15",
        "Jinja2>=2.10.1",
        "itsdangerous>=0.24",
        "click>=5.1",
    ],
    extras_require={"dotenv": ["python-dotenv"]},
)

The equivalent sections in setup.cfg would be:

[metadata]
name = Flask

[options]
install_requires =
    Werkzeug>=0.15
    Jinja2>=2.10.1
    itsdangerous>=0.24
    click>=5.1

[options.extras_require]
dotenv =
    python-dotenv

The dependency graph doesn't understand extras_require and setup_requires right now, but I figured I might as well include it since extras layout is different.

Use a declarative syntax to avoid mixing code and configuration. Simplifies handling of long description and version by reducing some boilerplate. For details on this setuptools feature, see: https://setuptools.readthedocs.io/en/latest/setuptools.html#configuring-setup-using-setup-cfg-files Django made the same move to setup.cfg in: django/django@85efc14 The name argument remains in setup.py for compatibility with GitHub's dependency/security features. See: github/semantic#562 Additionally: - Add 'Programming Language :: Python :: 3 :: Only' trove classifier. - Remove unnecessary long_description_content_type from setup as reStructuredText is the default. - Use HTTPs for GitHub URL in setup. - Add project URLs to setup.

adamchainz mentioned this issue May 25, 2020

Move setup information to declarative setup.cfg django/asgiref#161

Merged

github / semantic Public

Python pip setup.cfg #562

Python pip setup.cfg #562

adamchainz commented May 25, 2020

patrickt commented May 25, 2020

davidism commented May 25, 2020

github / semantic Public

Python pip setup.cfg #562

Python pip setup.cfg #562

Comments

adamchainz commented May 25, 2020

patrickt commented May 25, 2020

davidism commented May 25, 2020