pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684.
It is recommended that you:
Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option.
Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option.
Select a tool to bootstrap and then run tests such as tox.
This came up in a review of a proposed python-rfc3339-validator package for Fedora Linux.
What I Did
Followed pytest-runner upstream’s advice (leaving the already-empty setup_requires for now).
Verified I can still run the tests with tox.
I also tried to run the tests with pip install -r requirements_dev.txt followed by python -m pytest or pytest, but this didn’t work on Python 3.10 because of the old pinned versions in requirements_dev.txt. However, after pip install --upgrade pip tox coverage pytest hypothesis strict_rfc3339, I was able to run the tests this way too.
Description
The
pytest-runner
package is deprecated upstream. Its README now advises:This came up in a review of a proposed
python-rfc3339-validator
package for Fedora Linux.What I Did
pytest-runner
upstream’s advice (leaving the already-emptysetup_requires
for now).tox
.I also tried to run the tests with
pip install -r requirements_dev.txt
followed bypython -m pytest
orpytest
, but this didn’t work on Python 3.10 because of the old pinned versions inrequirements_dev.txt
. However, afterpip install --upgrade pip tox coverage pytest hypothesis strict_rfc3339
, I was able to run the tests this way too.I will offer these suggested changes as a PR.