6 ms·

> Why is this ecosystem considered acceptable? It largely isn't, but python is a big ship and it takes time to turn. There's been a lot of movement in python p

by Doxin 2y ago

> Why is this ecosystem considered acceptable? It largely isn't, but python is a big ship and it takes time to turn. There's been a lot of movement in python packaging semi-recently and as far as I can tell using setup.py has been considered legacy for a while now. Biggest problem is that the new way to do packaging is not documented very well. It's split over three or four different projects. It mostly amounts to "you need to make a pyproject.toml file" but it's somewhat tricky to find what such a file is even supposed to contain.

morkalork 2y ago
Again, why is this acceptable?
- Joker_vD 2y ago
  Okay, it's unacceptable. Now what? Sadly, we (you, I, the Python leadership) can't just visit every single Python package publisher/maintainer and ask politely but firmly ask them to fix their packaging issues. And even if we could, at least half of them would either ignore us or would mess up in some new, exciting ways while trying to adapt to the flavour du jour of Python packaging.
  - morkalork 2y ago
    I think the answer is to not have a flavour du jour. Pick one, crown it the winner, document it well and give it some time. If the solution is always changing, nobody is going to want to put the effort in.
    - oivey 2y ago
      This is really a great idea. Once we finalize the choice, when can we expect the upload into the hivemind?
      - Joker_vD 2y ago
        Right after the maintainers of libtelepathy.so release the version with Discord support.
    - Joker_vD 2y ago
      > I think the answer is to not have a flavour du jour. Pick one, crown it the winner, document it well and give it some time. It has been done with distutils: it has been around for more than a decade. The result is the ecosystem that you are complaining about.
    - kergonath 2y ago
      This is exactly our problem. We develop a couple of packages (which we don’t put on PyPI so any security issue is affects nobody except us). But it’s not our job and we cannot justify someone spending too much time on this. I have a look every now and then to try to figure out what we’re supposed to do, but there are 154 solutions, some of them are outdated and unmaintained, some of them are broken in more or less subtle ways, and some of them have a bare minimum of documentation. So yeah. We’ll change when we have a clear, documented path forward.
      - Joker_vD 2y ago
        Just put your package folder into a tarball as-is; to install, execute tar xzf our_custom_package.tar.gz -C "$(python3 -c 'import sysconfig; print(sysconfig.get_path("platlib"))')" I'm only half-joking.
vintagedave 2y ago
Not to mention that the Python packaging tutorial was missing a few bits, at least as of earlier this year: https://daveon.design/introducing-fontimize-subset-fonts-to-exactly-and-only-your-websites-used-characters.html#python-packaging-tutorial:-the-missing-bits https://daveon.design/introducing-fontimize-subset-fonts-to-...
cratermoon 2y ago
Speaking of poor programming practices, how about copy-pasting code without understanding it? Notice the author's mention of how many packages with -Ofast trace their lineage back through this comment: # Initially copied from # https://github.com/actions/starter-workflows/blob/main/ci/python-package.yml # And later based on the version jamadden updated at # gevent/gevent, and then at zodb/relstorage and zodb/perfmetrics Although the linked config was modified 2 years ago to removed the unsafe math options[1], the copy-paste propagated before then. Naturally anyone asking CoPilot, ChatGPT, or other modern LLM-based interface for config code will likely get something based on this, with the problematic -Ofast option included. [1] https://github.com/zopefoundation/meta/commit/9c07520e90d9a12e82c1b26501e20ba86e21312c https://github.com/zopefoundation/meta/commit/9c07520e90d9a1...

by Doxin 2y ago

morkalork 2y ago

Again, why is this acceptable?

Joker_vD 2y ago
Okay, it's unacceptable. Now what? Sadly, we (you, I, the Python leadership) can't just visit every single Python package publisher/maintainer and ask politely but firmly ask them to fix their packaging issues. And even if we could, at least half of them would either ignore us or would mess up in some new, exciting ways while trying to adapt to the flavour du jour of Python packaging.
- morkalork 2y ago
  I think the answer is to not have a flavour du jour. Pick one, crown it the winner, document it well and give it some time. If the solution is always changing, nobody is going to want to put the effort in.
  - oivey 2y ago
    This is really a great idea. Once we finalize the choice, when can we expect the upload into the hivemind?
    - Joker_vD 2y ago
      Right after the maintainers of libtelepathy.so release the version with Discord support.
  - Joker_vD 2y ago
    > I think the answer is to not have a flavour du jour. Pick one, crown it the winner, document it well and give it some time. It has been done with distutils: it has been around for more than a decade. The result is the ecosystem that you are complaining about.
  - kergonath 2y ago
    This is exactly our problem. We develop a couple of packages (which we don’t put on PyPI so any security issue is affects nobody except us). But it’s not our job and we cannot justify someone spending too much time on this. I have a look every now and then to try to figure out what we’re supposed to do, but there are 154 solutions, some of them are outdated and unmaintained, some of them are broken in more or less subtle ways, and some of them have a bare minimum of documentation. So yeah. We’ll change when we have a clear, documented path forward.
    - Joker_vD 2y ago
      Just put your package folder into a tarball as-is; to install, execute tar xzf our_custom_package.tar.gz -C "$(python3 -c 'import sysconfig; print(sysconfig.get_path("platlib"))')" I'm only half-joking.

vintagedave 2y ago

Not to mention that the Python packaging tutorial was missing a few bits, at least as of earlier this year: https://daveon.design/introducing-fontimize-subset-fonts-to-exactly-and-only-your-websites-used-characters.html#python-packaging-tutorial:-the-missing-bits https://daveon.design/introducing-fontimize-subset-fonts-to-...

cratermoon 2y ago

Speaking of poor programming practices, how about copy-pasting code without understanding it? Notice the author's mention of how many packages with -Ofast trace their lineage back through this comment: # Initially copied from # https://github.com/actions/starter-workflows/blob/main/ci/python-package.yml # And later based on the version jamadden updated at # gevent/gevent, and then at zodb/relstorage and zodb/perfmetrics Although the linked config was modified 2 years ago to removed the unsafe math options[1], the copy-paste propagated before then. Naturally anyone asking CoPilot, ChatGPT, or other modern LLM-based interface for config code will likely get something based on this, with the problematic -Ofast option included. [1] https://github.com/zopefoundation/meta/commit/9c07520e90d9a12e82c1b26501e20ba86e21312c https://github.com/zopefoundation/meta/commit/9c07520e90d9a1...