Replace bundled pip and setuptools with a downloader in the ensurepip module

[webknjaz]

BPO	36608
Nosy	@ericvsmith, @ned-deily, @serhiy-storchaka, @dstufft, @webknjaz, @pradyunsg
PRs	gh-80789: Implement build-time pip bundling in ensurepip #12791

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2019-04-11.22:13:02.045>
labels = ['3.8', 'type-feature', 'library', '3.9']
title = 'Replace bundled pip and setuptools with a downloader in the ensurepip module'
updated_at = <Date 2021-07-05.23:28:08.628>
user = 'https://github.com/webknjaz'

bugs.python.org fields:

activity = <Date 2021-07-05.23:28:08.628>
actor = 'ned.deily'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2019-04-11.22:13:02.045>
creator = 'webknjaz'
dependencies = []
files = []
hgrepos = []
issue_num = 36608
keywords = ['patch']
message_count = 6.0
messages = ['339998', '340039', '340060', '340169', '340218', '347836']
nosy_count = 6.0
nosy_names = ['eric.smith', 'ned.deily', 'serhiy.storchaka', 'dstufft', 'webknjaz', 'pradyunsg']
pr_nums = ['12791']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue36608'
versions = ['Python 3.8', 'Python 3.9']

Linked PRs

• GH-80789: Bundle ensurepip wheels at build time #109130
• GH-80789: Get rid of the ensurepip infra for many wheels #109245

[webknjaz]

Hi,

I've noticed that there's an idea to not pollute Git tree with vendored blobs. In particular, ensurepip is one of the components doing this.

Such a wish was expressed here: https://bugs.python.org/issue35277#msg330098

So I thought I'd take a stab at it...

[ericvsmith]

ensurepip does not access the network, by design. We do not want it to start access the network without a lot of discussion.

And if it does access the network, it will need to be able to use alternate URLs. For example: where I deploy Python, it would not have access to the URLs in your PR, but instead would need to specify a different (internal) location. This is the same reason that pip install has --find-links, --no-index, --extra-index-url, etc.

I think this would need a lot of discussion (probably on distutils-sig), and probably a PEP.

[ericvsmith]

And I don't mean to sound like a total downer. I just think it's important that we recognize all of the use cases.

Thanks for your work on this.

[pradyunsg]

(Not sure how the Roundup handles email replies but I'm hoping this goes to
the right place)

I think it would be better if the downloading got invoked during the
interpreter build process -- to download the wheels and add them to the
final distribution. This lets us remove the wheels from the source
tree/version control and prevents needing to change the PEP for this change.

Functionally, I imagine having all the download logic in some sort of
ensurepip._bootstrap which has all the download logic and that getting
invoked in the build process. python -m ensurepip not hitting the
internet is a good invariant to keep.

On Fri, 12 Apr 2019 at 8:54 PM, Eric V. Smith <report@bugs.python.org>
wrote:

Eric V. Smith <eric@trueblade.com> added the comment:

And I don't mean to sound like a total downer. I just think it's important
that we recognize all of the use cases.

Thanks for your work on this.

----------

---

Python tracker <report@bugs.python.org>
<https://bugs.python.org/issue36608\>

---

[serhiy-storchaka]

I proposed to move bundled pip and setuptools to the external repository and download them at build time like Tcl and other dependencies on Windows.

[webknjaz]

Thanks for the feedback!

I've changed it a bit to have a separate command for downloading bundles to the source tree. It'd work as in python -m ensurepip.bundle (needs a better name/CLI args probably).

Does it sound better now?