6 ms·

Pip 10 has been released

105 points by ognyankulev 9y ago

piinbinary 9y ago
Presumably it still supports Python 2.7, so this isn't actually the end of Python 2 support.
- eesmith 9y ago
  Correct. https://pypi.python.org/pypi/pip/10.0.0 https://pypi.python.org/pypi/pip/10.0.0 lists "Programming Language :: Python :: 2.7". 2.6 was released on 01-Oct-2008 and the last security-fix release was on October 29, 2013. Humorously, https://www.python.org/download/releases/2.6/ https://www.python.org/download/releases/2.6/ says "Python 2.6 has been replaced by a newer bugfix release of Python. Please download Python 2.6.7 instead." Following the link to 2.6.7 says "Python 2.6.7 has been replaced by a newer security-fix only source release of Python. Please download Python 2.6.8 instead." Following the link to 2.6.8 says "Please download Python 2.6.9 instead." Which finally took me to the final release of the 2.6 series.
  - tbodt 9y ago
    The reason it links you to 2.6.6 instead of 2.6.9 is because 2.6.6 is the newest version that has binaries available for download. You have to compile the newer versions from source if you want to use them.
    - eesmith 9y ago
      It never linked me to 2.6.6. It went to 2.6.7. 2.6.6 isn't mentioned at https://www.python.org/download/releases/2.6/ https://www.python.org/download/releases/2.6/ nor in my earlier comment.
- ognyankulev 9y ago
  Python 2.6 was 2% of pip downloads and apparently this was the rationale for dropping its support: https://github.com/pypa/pip/pull/4343 https://github.com/pypa/pip/pull/4343 . This led to some Python libraries to also drop 2.6, as shown by library commits referencing this pull request.
  - ams6110 9y ago
    RHEL/CentOS 6 stock python is 2.6, IIRC.
    - d33 9y ago
      RHEL/CentOS has a reputation of keeping up zombie software that is long unsupported by upstream. It's their model and their problem, rest of community shouldn't IMHO care. Hardly any projects have resources to keep compatibility with their ten-years-old releases and backport every fix.
    - lozenge 9y ago
      I doubt anybody running it is interested in upgrading their pip.
      - progval 9y ago
        You would be surprised at the requests I get from people running CentOS 6.
        Redoubts 9y ago
        Is there any reason those people can't leave their system python to the system, and otherwise bring their own?
        pletnes 9y ago
        They don’t know how. But anaconda python will work nicely on centos 6 I suspect.
        kalefranz 9y ago
        Quite nice. And likely faster and more secure. Do an independent check for yourself. Look at the compile flags. Along with what’s statically linked, vs what conda manages as dynamically linked. Also don’t miss what all the pip-installed wheels are statically linking.
no_wizard 9y ago
Yes! Very excited about this as it really feels like pip 9 was long overdue for an upgrade. Now if we can get the rest of the packaging story down for python it’d be great :) On another note: I thought Pipenv was going to supplant pip? https://packaging.python.org/tutorials/managing-dependencies/ https://packaging.python.org/tutorials/managing-dependencies... It felt like they were gearing up for it to be that way anyways
- ubernostrum 9y ago
  The tl;dr: * pip is the tool for installing packages * pipenv is the tool for managing an environment in which you develop a package (and wraps pip and virtualenv to make that convenient) * twine is the tool for uploading packages to the Python Package Index
  - Rotareti 9y ago
    pip, pipenv, pipfile, pipfile.lock, twine, project.toml, setup.py, setup.cfg, setuptools, requirements.txt... I'd prefer a proper package manager.
    - ubernostrum 9y ago
      So build one. If it's good, people will use it!
      - Rotareti 9y ago
        Luckily I don't have to! I rather contribute to this, which looks promising: https://github.com/sdispater/poetry https://github.com/sdispater/poetry
        no_wizard 9y ago
        Oh man I did not know this existed I am completely aligned with this. Easily this is what I love About the python community is that so many awesome folks just step up and do something when they seen deficiencies vs waiting for someone else to get around to it (lookin at you Swift) I myself am prototyping a tool chain that will compile python to static C code and then compile that (with the interpreter embedded) into a binary that can be easily distributed. Nothing on GitHub yet but it’s what I hope one day soon will fix the distribution story once and for all!
mistrial9 9y ago
right in the middle of pip-conda-deb / py27-py35-py36 conflicts here.. I was startled to see a pip 9.0.3 msg "urllib3- download is not secure, get the newest version of python" first thanks very much for all the work in the ecosystem.. not kidding. huge respect to the SciPy stack .. and others coming up now.. second, is this pip 9 msg really a veiled coercian to use Python 3x !?! really? using security cert FUD .. I really hope this is not the right interpretation of the msgs I saw on an ubuntu server yesterday.. It is a breach of trust, and so wrong on so many levels.. DO not become what you despise.
- no_wizard 9y ago
  There does not seem to be any evidence that this is even remotely the case.
- adrian17 9y ago
  The package index recently dropped TLS1.0/1.1 support; in some cases, like old not-upgraded Ubuntu 12 servers, OpenSSL had to be upgraded for pip to work. Maybe that's the issue you encountered? https://github.com/pypa/warehouse/issues/3411 https://github.com/pypa/warehouse/issues/3411
- lvh 9y ago
  PyPI has started requiring modern, secure TLS (TLS 1.2) to download stuff. You don't need Python 3, but you do need a more recent Python or at least one compiled against a more recent libssl. Which one are you running and do you have the exact error message?

105 points by ognyankulev 9y ago

piinbinary 9y ago

Presumably it still supports Python 2.7, so this isn't actually the end of Python 2 support.

eesmith 9y ago
Correct. https://pypi.python.org/pypi/pip/10.0.0 https://pypi.python.org/pypi/pip/10.0.0 lists "Programming Language :: Python :: 2.7". 2.6 was released on 01-Oct-2008 and the last security-fix release was on October 29, 2013. Humorously, https://www.python.org/download/releases/2.6/ https://www.python.org/download/releases/2.6/ says "Python 2.6 has been replaced by a newer bugfix release of Python. Please download Python 2.6.7 instead." Following the link to 2.6.7 says "Python 2.6.7 has been replaced by a newer security-fix only source release of Python. Please download Python 2.6.8 instead." Following the link to 2.6.8 says "Please download Python 2.6.9 instead." Which finally took me to the final release of the 2.6 series.
- tbodt 9y ago
  The reason it links you to 2.6.6 instead of 2.6.9 is because 2.6.6 is the newest version that has binaries available for download. You have to compile the newer versions from source if you want to use them.
  - eesmith 9y ago
    It never linked me to 2.6.6. It went to 2.6.7. 2.6.6 isn't mentioned at https://www.python.org/download/releases/2.6/ https://www.python.org/download/releases/2.6/ nor in my earlier comment.
ognyankulev 9y ago
Python 2.6 was 2% of pip downloads and apparently this was the rationale for dropping its support: https://github.com/pypa/pip/pull/4343 https://github.com/pypa/pip/pull/4343 . This led to some Python libraries to also drop 2.6, as shown by library commits referencing this pull request.
- ams6110 9y ago
  RHEL/CentOS 6 stock python is 2.6, IIRC.
  - d33 9y ago
    RHEL/CentOS has a reputation of keeping up zombie software that is long unsupported by upstream. It's their model and their problem, rest of community shouldn't IMHO care. Hardly any projects have resources to keep compatibility with their ten-years-old releases and backport every fix.
  - lozenge 9y ago
    I doubt anybody running it is interested in upgrading their pip.
    - progval 9y ago
      You would be surprised at the requests I get from people running CentOS 6.
      - Redoubts 9y ago
        Is there any reason those people can't leave their system python to the system, and otherwise bring their own?
        pletnes 9y ago
        They don’t know how. But anaconda python will work nicely on centos 6 I suspect.
        kalefranz 9y ago
        Quite nice. And likely faster and more secure. Do an independent check for yourself. Look at the compile flags. Along with what’s statically linked, vs what conda manages as dynamically linked. Also don’t miss what all the pip-installed wheels are statically linking.

no_wizard 9y ago

Yes! Very excited about this as it really feels like pip 9 was long overdue for an upgrade. Now if we can get the rest of the packaging story down for python it’d be great :) On another note: I thought Pipenv was going to supplant pip? https://packaging.python.org/tutorials/managing-dependencies/ https://packaging.python.org/tutorials/managing-dependencies... It felt like they were gearing up for it to be that way anyways

ubernostrum 9y ago
The tl;dr: * pip is the tool for installing packages * pipenv is the tool for managing an environment in which you develop a package (and wraps pip and virtualenv to make that convenient) * twine is the tool for uploading packages to the Python Package Index
- Rotareti 9y ago
  pip, pipenv, pipfile, pipfile.lock, twine, project.toml, setup.py, setup.cfg, setuptools, requirements.txt... I'd prefer a proper package manager.
  - ubernostrum 9y ago
    So build one. If it's good, people will use it!
    - Rotareti 9y ago
      Luckily I don't have to! I rather contribute to this, which looks promising: https://github.com/sdispater/poetry https://github.com/sdispater/poetry
      - no_wizard 9y ago
        Oh man I did not know this existed I am completely aligned with this. Easily this is what I love About the python community is that so many awesome folks just step up and do something when they seen deficiencies vs waiting for someone else to get around to it (lookin at you Swift) I myself am prototyping a tool chain that will compile python to static C code and then compile that (with the interpreter embedded) into a binary that can be easily distributed. Nothing on GitHub yet but it’s what I hope one day soon will fix the distribution story once and for all!

mistrial9 9y ago

right in the middle of pip-conda-deb / py27-py35-py36 conflicts here.. I was startled to see a pip 9.0.3 msg "urllib3- download is not secure, get the newest version of python" first thanks very much for all the work in the ecosystem.. not kidding. huge respect to the SciPy stack .. and others coming up now.. second, is this pip 9 msg really a veiled coercian to use Python 3x !?! really? using security cert FUD .. I really hope this is not the right interpretation of the msgs I saw on an ubuntu server yesterday.. It is a breach of trust, and so wrong on so many levels.. DO not become what you despise.

no_wizard 9y ago
There does not seem to be any evidence that this is even remotely the case.
adrian17 9y ago
The package index recently dropped TLS1.0/1.1 support; in some cases, like old not-upgraded Ubuntu 12 servers, OpenSSL had to be upgraded for pip to work. Maybe that's the issue you encountered? https://github.com/pypa/warehouse/issues/3411 https://github.com/pypa/warehouse/issues/3411
lvh 9y ago
PyPI has started requiring modern, secure TLS (TLS 1.2) to download stuff. You don't need Python 3, but you do need a more recent Python or at least one compiled against a more recent libssl. Which one are you running and do you have the exact error message?