Run setup.py (instead of just parsing it) to gather more data

l1k commented 11 years ago

Hi Sascha,

I'd be interested to get feedback from you on this experimental feature and specifically on the following issues:

tarfile.extractall() does not protect against overwriting files outside of tempdir (pathnames which are absolute or with "../" at the beginning; zipfile.extractall() attempts to prevent that). One solution would be to use setuptools.sandbox.DirectorySandbox. That's what setuptools.sandbox.run_setup() does. The downside is that obviously setuptools needs to be installed, so it adds another prerequisite to py2pack.
setuptools.sandbox.run_setup() saves (and later restores) more state than I do, e.g. sys.modules and sys.argv. Not sure if that is actually necessary.
Running setup.py is risky (execution of foreign/untrusted code). That is one of the reasons I've made this feature optional. However, _parse_setup_py() calls eval() on portions of setup.py so it can be argued that execution of foreign code already happens anyway.
Execution of setup.py might fail. We could catch any exceptions and fall back to regular "parse" mode in that case.

Let me know what you think. Thanks.

l1k commented 11 years ago

I finally threw in the towel and switched from distutils to setuptools in commit 8494ee6182a8af573d4a9df58979ef7f728d9d2c

Turns out there are packages which dynamically generate the install_requires parameter (e.g. paramiko). So I can't retrieve the value of that parameter by parsing it with a regex, and I can't retrieve it from the distutils.dist.Distribution object either because distutils doesn't support the install_requires parameter. Only setuptools does. Switching to setuptools thus seemed to be the only viable solution.

aspiers commented 9 years ago

Does this fix #25?

aspiers commented 9 years ago

Just tried it and when run with the -r switch it seems to do the trick. Cool!

toabctl commented 9 years ago

@saschpe what do you think about this PR? It's open now for over 1 1/2 years without any comment.

saschpe commented 9 years ago

Works for me, needs a rebase though :-)

toabctl commented 9 years ago

@l1k still interested in this?

l1k commented 9 years ago

@toabctl: Sure, I'll look into it, see what's necessary to rebase it on current master. Thanks for following up on this.

l1k commented 9 years ago

Voilà, rebased and force-pushed. Thanks again.

openSUSE / py2pack

Run setup.py (instead of just parsing it) to gather more data #9