Versions of the form "0.23ubuntu1" do not obey PEP440 and break current pip/setuptools

Bug #2003583 reported by Adam Novak
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
distro-info (Ubuntu)
Fix Released
High
Unassigned
reportbug (Ubuntu)
Fix Released
High
Unassigned

Bug Description

With setuptools 66, the versions of all packages visible in the Python environment *must* obey PEP440 <https://peps.python.org/pep-0440/>. Otherwise, attempts to use pip to install a package with a setup.py-based build system, or other attempts to use the `pkg-resources` module, can produce errors like this:

  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/__init__.py", line 844, in _resolve_dist
    env = Environment(self.entries)
  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/__init__.py", line 1044, in __init__
    self.scan(search_path)
  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/__init__.py", line 1077, in scan
    self.add(dist)
  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/__init__.py", line 1096, in add
    dists.sort(key=operator.attrgetter('hashcmp'), reverse=True)
  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2631, in hashcmp
    self.parsed_version,
  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2678, in parsed_version
    self._parsed_version = parse_version(self.version)
  File "/builds/databiosphere/toil/venv/lib/python3.9/site-packages/pkg_resources/_vendor/packaging/version.py", line 266, in __init__
    raise InvalidVersion(f"Invalid version: '{version}'")
pkg_resources.extern.packaging.version.InvalidVersion: Invalid version: '0.23ubuntu1'

The official opinion of the setuptools maintainers seems to be that version strings of this form haven't *really* been allowed since about 2014, and distributions need to change their package version naming scheme for Python packages they install, so that the resulting version strings obey PEP440. See for example <https://github.com/pypa/setuptools/issues/3772#issuecomment-1384342813>.

Therefore, the version of the `distro-info` package shipped in Focal cannot remain '0.23ubuntu1', at least as exposed to the Python environment in `python3-distro-info`. A new version needs to be released where the version string that Python code sees follows https://peps.python.org/pep-0440/#public-version-identifiers or https://peps.python.org/pep-0440/#local-version-identifiers

Other versions of `distro-info` as shipped in other reasonably current Ubuntu versions would also need to be changed:

1.1build1 in Jammy
1.1ubuntu1 in Kinetic

Older Ubuntu releases that are still "supported" might also need changes.

Revision history for this message
Adam Novak (interfect) wrote :

As noted in <https://github.com/pypa/setuptools/issues/3772#issuecomment-1385141558>, `python3-reportbug` ships a disallowed version string all the way up to Lunar.

Revision history for this message
Benjamin Drung (bdrung) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. The pointer to https://github.com/pypa/setuptools/issues/3772 is really useful.

The bug report against distro-info is a duplicate of bug #1991606. Please follow up there for distro-info.

Changed in distro-info (Ubuntu):
status: New → Fix Released
Revision history for this message
Benjamin Drung (bdrung) wrote :

This bug is a duplicate of bug #1991606 but due to bug #2008514 it runs into a timeout when marking as duplicate. Since distro-info and reportbug in Ubuntu 23.04 (lunar) are fixed, I am marking this bug is fixed as well. Please follow bug #1991606 for the updates to the stable releases.

Changed in reportbug (Ubuntu):
status: New → Fix Released
importance: Undecided → High
Changed in distro-info (Ubuntu):
importance: Undecided → High
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.