Closed black-snow closed 7 months ago
dimbleby
commented
7 months ago there is some sort of screw-up between docutils and pypi, see https://pypi.org/project/docutils/0.21/#files - the source distribution has been uploaded as docutils-0.21.post1.tar.gz
you should likely report this:
joekiller
commented
7 months ago @dimbleby @black-snow
Hello! I have tracked down this issue and it is poetry's pypi resolver. Please see this repository for details.
https://github.com/joekiller/poetry-post-release-issue
Edit, I'll copy and paste the explanation and workaround here from the README.md:
Proof of concept and analysis regarding https://github.com/python-poetry/poetry/issues/9293
This project shows an example of where poetry fails to properly resolve the latest release due to an update utilizing the post-release specifier which will not be reflected in the Release key of the project api as it is considered a non-version changing release.
Example case docutils~=0.21. When docutils 0.21 was released there was a post-release 0.21.post1 version created which
does not appear as a release as it is still considered 0.21.
When poetry resolved the versions in via https://pypi.org/pypi/docutils/json it found 0.21.post1 however when it
goes for https://pypi.org/pypi/docutils/0.21.post1/json that will not be there because 0.21 is the correct version.
Poetry is trying to hit the release api of a version that will not exist.
Poetry should instead look for the 0.21 version instead of 0.21.postX version.
Many people will report adding a non-priority indicated pypi fixes this issue. For example adding:
[[tool.poetry.source]]
name = "pypi-public"
url = "https://pypi.org/simple/"There are two reasons why this workaround "works":
The bug occurs when a post release is in pypi and there isn't a poetry.lock specifying what to resolve.
The pypi_repository._get_release_info will end up throwing PackageNotFound due to the json_data not resolving for the post release version.
There are several ways in which one could fix this.
or
version.release instead of version during the _get_release_info
call of the pypi_repository.If you ever get a poetry.lock file, then the dependencies will not be resolved, and it's hard to track this issue.
I found this because a colleague mentioned the issue, and it appears the dependency was updated April 9th and today is April 10th making timing crucial in being able to sniff this out.
black-snow
commented
7 months ago That's awesome @joekiller, thanks. I'll update the title to reflect your findings.
dimbleby
commented
7 months ago I do not think a poetry fix is likely here: the root cause is that pypi is providing inconsistent information (namely there is a distribution with version 0.21.post1, but no corresponding release).
Much the fastest likely route to sorting this out is for docutils to publish a fixed release.
Longer term
dimbleby
commented
7 months ago rereading what @joekiller wrote, I think that most of it is a wrong generalization, based on a misunderstanding.
it is not expected that distributions for a post release be bundled together with the original release: there should be a whole separate release. eg compare https://pypi.org/project/tensorflow/2.15.0/ and https://pypi.org/project/tensorflow/2.15.0.post1/
poetry "fails to resolve post-release versions via default pypi provider" is simply not true. things are going wrong in this specific instance because this specific package has been mis-published
joekiller
commented
7 months ago @dimbleby thanks for reading the analysis. I agree that the post-release guidance indicates that the indicator should be present, regardless of non-code changes. The premise in this issue should be closed as it's a botched release by docutils.
black-snow
commented
7 months ago I reverted the issue's title.
I wonder how pip is then able to install it.
I'll get in touch w/ warehouse and close this one. Thanks a ton to both of you!
black-snow
commented
7 months ago 
github-actions[bot]
commented
6 months ago This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Description
Cross-posting https://github.com/pypa/twine/issues/1082 for I think it's rather an issue with poetry.
When I try
poetry add twinein a real or an empty project I receive:I don't quite see why but I'll post the debug info below.
Workarounds
Works when installed via pip.
Works when I add
0.21without the nonexistingpost1to the dev dependencies explicitly. Can't spot where the dependency comes from - graph yields nothing for it cannot be installed but pip does neither.Poetry Installation Method
other
Operating System
macOS
Poetry Version
1.8.2_1
Poetry Configuration
Python Sysconfig
Example pyproject.toml
Poetry Runtime Logs