Pip: VCS link in 'install_requires' in `setup.py` does not work

[kkom]

Environment

• pip version: 20.0.2
• Python version: 3.8
• OS: Debian GNU/Linux 10 (buster)

Description

I want to use a VCS requirement specifier in the 'install_requires' section of a setup.py file, such as git+git://github.com/....

python setup.py install --user fails with this error message:

error in goblin setup command: 'install_requires' must be a string or list of strings containing valid project/version requirement specifiers; Invalid requirement, parse error at "'+git://g'"

Expected behavior

I would expect the installation to succeed and install a dependency exactly as specified in setup.py.

How to Reproduce

Use this setup.py file from https://github.com/kkom/goblin/blob/4d112b95dfd2374363b4617b08d3f0689957ea73/setup.py :

"""Python toolkit for Tinker Pop 3 Gremlin Server."""

import os
from setuptools import find_packages, setup


__author__ = 'Jeffrey Phillips Freeman'
__email__ = '[email protected]'
__license__ = 'Apache License, Version 2.0'
__copyright__ = 'Copyright 2017, CleverThis, Inc. and contributors'
__credits__ = ['David M. Brown - Project founder']

with open("README.md", "r") as fh:
    long_description = fh.read()

setup(
    name='goblin',
    version='2.2.4',
    license=__license__,
    author=__author__,
    author_email=__email__,
    description='Goblin OGM for the Tinkerpop 3 Stack,',
    long_description_content_type="text/markdown",
    long_description=long_description,
    url='http://goblin-ogm.com',
    download_url='https://github.com/goblin-ogm/goblin/archive/v2.2.4.tar.gz',
    include_package_data=True,
    keywords=['Tinkerpop', 'Tinkerpop3', 'gremlin', 'gremlin-python', 'asyncio', 'graphdb', 'ogm', 'orm'],
    packages=find_packages(),
    python_requires='>=3.5',
    install_requires=[
        'git+git://github.com/kkom/aiogremlin.git@301c9d1dd0cf07b50934c8df2b51084acea86cd7',
    ],
    test_suite='tests',
    setup_requires=[
        'pytest-runner>=2.6.2',
    ],
    tests_require=['check-manifest>=0.25',
                   'isort>=4.2.2',
                   'pydocstyle>=1.0.0',
                   'pytest-asyncio>=0.8.0',
                   'pytest-cache>=1.0',
                   'pytest-cov>=2.5.1',
                   'pytest-pep8>=1.0.6',
                   'pytest-timeout>=1.3.4',
                   'pytest>=3.2.1',
                   'uvloop>=0.8.1',
                   'mock'],
    classifiers=[
        'Development Status :: 5 - Production/Stable',
        'Intended Audience :: Developers',
        'License :: OSI Approved :: Apache Software License',
        'Operating System :: OS Independent',
        'Programming Language :: Python',
        'Programming Language :: Python :: 3',
        'Programming Language :: Python :: 3.5',
        'Programming Language :: Python :: 3.6',
        'Programming Language :: Python :: 3.7',
        'Programming Language :: Python :: 3.8',
        # uncomment if you test on these interpreters:
        # 'Programming Language :: Python :: Implementation :: IronPython',
        # 'Programming Language :: Python :: Implementation :: Jython',
        # 'Programming Language :: Python :: Implementation :: Stackless',
        'Programming Language :: Python :: Implementation :: PyPy'
    ]
)

Output

root@d6698cc1fa7a:/workspaces/goblin# python setup.py install --user
error in goblin setup command: 'install_requires' must be a string or list of strings containing valid project/version requirement specifiers; Invalid requirement, parse error at "'+git://g'"

Extra notes

I am aware that pinning dependencies so precisely in 'install_requires' is a complete antipattern.

I am doing it only because I'm fixing a blocking bug in aiogremlin, which is a dependency of goblin - a package that I'm using in my program.

I'm also trying to solve this problem in a different way, if you're interested: https://github.com/jazzband/pip-tools/issues/1111

[McSinyx]

Hi there, I believe the correct format for VCS dependency would be install_requires=['aiogremlin @ git+.... Additionally the use of git+git is discouraged because of security reasons (8f0dbec5734c5197c3b7070987814b584e3f31a6), for GitHub it's recommended to use git+https instead. Hopefully this solves the problem for you.

[kkom]

Thanks @McSinyx, this solved it!

And yes - good point about the security gains from using https!

[kkom]

Actually, your solution also solves my problem on the other issue: https://github.com/jazzband/pip-tools/issues/1111

Triple win! Thanks @McSinyx!