pypa / pipenv

Python Development Workflow for Humans.
https://pipenv.pypa.io
MIT License
24.85k stars 1.87k forks source link

Recommended install command broken in newer Python versions #6264

Open mcandre opened 2 weeks ago

mcandre commented 2 weeks ago

Issue description

The recommended way to install pipenv breaks on newer Python versions. For example, Ubuntu's pip now bans installing packages (both globally as well as by --user).

https://pipenv.pypa.io/en/latest/

Also, modern Python pip installations tend to name the application pip3 instead of pip, often reserving the latter for use with python v2.

Expected result

The recommended command for installing pipenv should reflect current best practices for Python package management.

Actual result

Ubuntu 24.04 in GitHub Actions shows installation of pipenv failing:

$ pip install --user pipenv
error: externally-managed-environment
× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
    python3-xyz, where xyz is the package you are trying to
    install.

    If you wish to install a non-Debian-packaged Python package,
    create a virtual environment using python3 -m venv path/to/venv.
    Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
    sure you have python3-full installed.

    If you wish to install a non-Debian packaged Python application,
    it may be easiest to use pipx install xyz, which will manage a
    virtual environment for you. Make sure you have pipx installed.

    See /usr/share/doc/python3.12/README.venv for more information.
note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.

Steps to replicate

  1. Run the recommended command for acquiring pipenv in Ubuntu 24.04.

Workaround

Although this overcomplicates dev environment setup, planning to move pipenv provisioning from my usual platform agnostic requirements.txt requirements-dev.txt configuration files to platform specific commands.

However, installing pip packages outside of infrastructure as code files tends to restrict the ability of SCA tools to collect complete and accurate SBOM data for security scans.

Notes

If only Python (pip) would include pipenv by default, as it does with pipx.

matteius commented 1 day ago

Analysis for Issue #6264:

Analysis of Pipenv Issue #6264

1. Summary of the Problem:

The issue highlights two problems with Pipenv's recommended installation command: