[Python-modules-team] Bug#771794: Bug#771794: pip silently removes/updates system provided python packages

[Barry Warsaw]

On Dec 03, 2014, at 03:20 PM, Piotr Ożarowski wrote:

>IMO we should patch pip to *not* touch (install, upgrade, uninstall,
>etc.) anything in /usr directory (or /) except /usr/local. Our Python
>interpreter already installs to /usr/local and so should pip.

+1

>This way:
> * pip doesn't need to figure out which file can be touched,
> * we can detect cause of problems just by looking at traceback
>   (right now the very first thing I do once someone sends me a
>   traceback is to look for .egg files in there (thank you ez_install!);
>   with pip installing/overwriting files in /usr instead of /usr/local
>   it's not that easy, not to mention that it will be a lot harder to
>   fix it after such "install")
> * we'll be able to easily prove to our users that we're not insane
>   and we did test our stuff ("please rename
>   /usr/local/pythonX.Y/dist-packages to something else for few minutes
>   and try again")

Don't forget that `$python -S` disables `import site` which has the side
effect of not including /usr/local on sys.path.  E.g.

% python3 -c "import sys; print(sys.path)"
['', '/home/barry/env/python', '/usr/lib/python3.4', '/usr/lib/python3.4/plat-x86_64-linux-gnu', '/usr/lib/python3.4/lib-dynload', '/home/barry/.local/lib/python3.4/site-packages', '/usr/local/lib/python3.4/dist-packages', '/usr/lib/python3/dist-packages']
% python3 -S -c "import sys; print(sys.path)"
['', '/home/barry/env/python', '/usr/lib/python3.4/', '/usr/lib/python3.4/plat-x86_64-linux-gnu', '/usr/lib/python3.4/lib-dynload']

Unfortunately, as you can see, this also disables
/usr/lib/python3/dist-packages so it it's a perfect way of telling people
"let's disable any non-apt managed packages".

I would support adding a special Debian -X switch which removes /usr/local
paths from sys.path.  Then, if you suspect some local outside-apt
customization is causing them problems you can ask them to run:

$ python3 -X ignore-debian-usr-local-customizations

(spelling TBD)