Pip: Removing support for git+git@ VCS requirement scheme

[sbidoul]

What's the problem this feature will solve?

In addition to VCS requirements which have the form of a proper URL, pip also partially supports a git specific scheme of the form [email protected]:user/repo.git. As currently documented, this scheme is supported for editable installs only.

Supporting this scheme has a number of drawbacks:

• This creates confusion when people try to use it without the --editable option (#2994, #6293).
• This also creates bugs, such as when adding the commit to the requirement, pip freeze generates requirements that pip cannot process (#2038).
• This specific format is not a proper URL, making such requirement impossible to translate to PEP 440 direct URL references.
• it would seem that support for this format is rather accidental in the pip code base (https://github.com/pypa/pip/issues/2038#issuecomment-570065043, also illustrated by the fact that link.is_vcs returns False for such pseudo-URLs), and properly supporting it everywhere would be very complex.

This scheme is easily replaced by URLs such as

• git+https://[email protected]/...
• git+ssh://[email protected]/...
• git+git://[email protected]/... (insecure)

Describe the solution you'd like

Deprecate support for this format during one year, then remove it (#7543).

Alternative solutions

• fix issues as they are discovered (e.g. support this format for non-editable uses, make pip freeze transform the reference to a supported format)
• do nothing, document the exceptions

[pradyunsg]

This was released in 20.0, so 21.0 should remove this feature.

[lericson]

It is not possible to make a relative path with the URL syntax. This artificially limit the power of pip for no reason. git+… simply passes … to git clone …. For example, if I have a branch that I want to install as a dependency:

pip install -e git+./@mydep#egg=mydep

This _WILL_ break existing software and there will be no fix.

[lericson]

Never mind, I found a workaround using the environment variable support in requirements.txt:

-e git+file://${PWD}@mydep#egg=mydep

[sbidoul]

@lericson interesting trick you found there.

Out of curiosity is this a real example using the current directory, and why can't you use -e .?

[lericson]

The idea is to bundle slightly modified dependencies as branches in Git, then let pip install them. I'm still trying to find out how well it works though.

[lericson]

Apart from needing a bit of an incantation to make the dependency remote refs into local refs, it works pretty good!

[sbidoul]

@lericson good to hear! Note that if you don't specifically need an editable install, you could also use the PEP 508 notation: mydep @ git+file://${PWD}@branch.

[lericson]

It actually works pretty well. The advantage of having an editable install is that it’s, well, editable. I do a fair amount of hacking on my dependencies if they’re not very mature projects. This fits that pattern well without complicating things for my users (and myself as a developer)

• Ludvig

On 14 Aug 2020, at 19:06, Stéphane Bidoul [e-mail] wrote:


@lericson good to hear! Note that if you don't specifically need an editable install, you could also use the PEP 508 notation: mydep @ git+file://${PWD}@branch.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

[uranusjr]

Be careful that PWD is not available on Windows, so you may need to jump through some hoops if you need to support that sometime.

[lericson]

Eh, I gave up on Windows compatibility a long time ago :-)