clarify CA cert issue; install virtualenv as well; mention Python 2.7 possibility

This commit is contained in:
Richard Jones 2013-07-10 13:01:57 +10:00
parent 3a283f9827
commit 12c9125cc2
1 changed files with 24 additions and 10 deletions

View File

@ -45,6 +45,12 @@ Python installation the barrier to installing additional software is
considerably reduced. It is hoped that this will therefore increase
the likelihood that Python projects will reuse third party software.
The Python community also has an issue of complexity around the current
bootstrap procedure for pip, setuptools and virtualenv. They all have
their own bootstrap download file with slightly different usages and
even refer to each other in some cases. Having a single bootstrap which
is common amongst them all, with a simple usage, would be far preferable.
It is also hoped that this is reduces the number of proposals to
include more and more software in the Python standard library, and
therefore that more popular Python software is more easily upgradeable
@ -54,6 +60,9 @@ beyond requiring Python installation upgrades.
Proposal
========
The bootstrap will install the pip implementation, setuptools and virtualenv
by downloading their installation files from PyPI.
This proposal affects two components of packaging: `the pip bootstrap`_ and,
thanks to easier package installation, `modifications to publishing
packages`_.
@ -68,11 +77,11 @@ The pip bootstrap
The Python installation includes an executable called "pip3" (see PEP 394 for
naming rationale etc.) that attempts to import pip machinery. If it can then
the pip command proceeds as normal. If it cannot it will bootstrap pip by
downloading the pip implementation and setuptools wheel files. Hereafter the
installation of the "pip implementation" will imply installation of
setuptools. Once installed, the pip command proceeds as normal. Once the
bootstrap process is complete the "pip3" command is no longer the bootstrap
but rather the full pip command.
downloading the pip implementation, setuptools and virtualenv wheel files.
Hereafter the installation of the "pip implementation" will imply installation
of setuptools and virtualenv. Once installed, the pip command proceeds as
normal. Once the bootstrap process is complete the "pip3" command is no longer
the bootstrap but rather the full pip command.
A boostrap is used in the place of a the full pip code so that we don't have
to bundle pip and also pip is upgradeable outside of the regular Python
@ -114,12 +123,13 @@ to PyPI.
Some users may have no Internet access suitable for fetching the pip
implementation file. These users can manually download and install the
setuptools and pip tar files. Adding specific support for this use-case is
unnecessary.
setuptools, virtualenv and pip tar files. Adding specific support for this
use-case is unnecessary.
The download of the pip implementation install file will be performed
securely. The transport from pypi.python.org will be done over HTTPS with the
CA certificate check performed (see PEP XXXX).
CA certificate check performed. This facility will be present in Python 3.4+
using Operating System certificates (see PEP XXXX).
Beyond those arguments controlling index location and download
options, the "pip3" boostrap command may support further standard pip
@ -173,13 +183,17 @@ The changes to pip required by this PEP are being tracked in that project's
issue tracker [2]_. Most notably, the addition of --bootstrap and --bootstrap-
to-system to the pip command-line.
It would be preferable that the pip, setuptools and virtualenv projects
distribute a wheel format download.
The required code for this implementation is the "pip3" command described
above. The additional pypublish can be developed outside of the scope of this
PEP's work.
Finally, it would be desirable that "pip3" be ported to Python 2.6+ to allow
the single command to replace all existing pip/setuptools/distribute and
possibly virtualenv bootstrap scripts.
the single command to replace all existing pip, setuptools and virtualenv
bootstrap scripts. Having that bootstrap included in a future Python 2.7
release would also be highly desirable.
Risks