pypa / installer

A low-level library for installing from a Python wheel distribution.
https://installer.readthedocs.io/
MIT License
126 stars 52 forks source link

Handle wheels whose RECORD file doesn't match #100

Open frostming opened 2 years ago

frostming commented 2 years ago

I understand it is the packagers' fault that released a wheel with a mismatching RECORD file. But since pip isn't that strict, people will keep complaining "I can't install xxx but pip works fine." At least installer could provide an option to skip the RECORD validation.

Some examples:

The errors are like:

File "C:\Users\user\AppData\Roaming\pdm\venv\lib\site-packages\pdm\installers\installers.py", line 280, in _install_wheel
  File "C:\Users\user\AppData\Roaming\pdm\venv\lib\site-packages\installer\sources.py", line 170, in get_contents
    assert record is not None, "In {}, {} is not mentioned in RECORD".format(
AssertionError: In C:\Users\user\AppData\Local\Temp\pip-unpack-a3gqvydj\catboost-1.0.4-cp39-none-win_amd64.whl, catboost/core.py is not mentioned in RECORD
pradyunsg commented 2 years ago

Well, of course pip just accepts such wheels. :)

Longer term, I think the right thing to do here is for pip to become strict on this front. That isn't happening over the weekend tho. I think adding a yield_files_missing_in_record arg[^1] that defaults to False and changes this into fabricating a RecordEntry with no size or hash is a reasonable idea.

Combined with #105, I think this is a reasonable thing to do.

[^1]: Let's defer bikeshedding on the name please. 😅