[Grok-dev] grokproject pins setuptools, zc.buildout et.al.

[Maurits van Rees]

Roger Erens, on 2009-11-10:
>
> On Tue, Nov 10, 2009 at 12:32, Maurits van Rees wrote:
>> Roger Erens, on 2009-11-10:
>>> I don't understand; can you elaborate? I mean, someone who can edit
>>> buildout.cfg is also able to edit setup.py. Or isn't that the issue?
>>
>> If the setup.py is in your own package, say a package you wrote for a
>> client: sure.
>>
>> But here the point is that for example the setup.py in the official
>> grok egg should *not* pin exact versions (and for the record: it does
>> not currently).  If we had for example said in the setup.py
>> "install_requires=['setuptools==0.6c9']" then someone who wanted to
>> use setuptools 0.6c11 would be *forced* to edit the setup.py of their
>> local copy of the grok egg and that is not good.
>>
>> Is that clearer?
>
> Yes, thanks. I had never given the setup.pys in eggs any
> thought. But this is just about the point w.r.t. the exact versions
> vs. the minimum versions in setup.py; how about the point
> w.r.t. empty vs. non-empty setup.py?

If you have a dependency you should specify it, otherwise your package
will not work.  You cannot depend on users of your package to read the
pypi page of your package and add any dependencies themselved manually
to their buildout.cfg.

I encountered that in an own package recently.
Products.eXtremeManagement (project management tool in Plone) depended
on xm.tracker in its setup.py.  xm.tracker needed egenix-mx-base (for
the mx.DateTime module) but did not specify this in its dependencies.
The reason was that egenix-mx-base was not on pypi at the time so the
dependency could not be resolved by buildout anyway.  This was
described in the readme and on pypi, but someone did not read that and
the missing dependency caused errors on his plone site.

There is some middle ground of course.  For example at Zest Sofware if
we build a package for a client and it needs a third party product we
usually do not specify this in the setup.py but only in the
buildout.cfg.  The package is not going to be reused anyway.  This way
the information is in one place.

And if you are in Plone land and you have a package that needs Plone
and works on Plone 3.0 and higher, you cannot specify 'Plone>=3.0' as
Plone is only eggified since 3.2.  So if you put this in your setup.py
you make it hard for people on Plone 3.0 and 3.1 to use your package.
(Some fake-eggs might help but I have not tried.)

-- 
Maurits van Rees | http://maurits.vanrees.org/
            Work | http://zestsoftware.nl/
"This is your day, don't let them take it away." [Barlow Girl]