Skip to content

[BUG] Vendored packages include incomplete dist-info data in wheels #4594

@freakboy3742

Description

@freakboy3742

setuptools version

setuptools>=73.0

Python version

3.8+

OS

macOS

Additional environment information

No response

Description

Setuptools contains a number of vendored packages. In Setuptools 71.0.0 and earlier (inclusive), these were "just folders" - the contents of the code for those dependencies, included in the setuptools package so the dependencies could be used without the bootstrapping issue of installing the dependencies of a dependency management tool.

As of 00384a5, released in Setuptools 71.0.1, these vendored packages also include the dist-info data for those packages.

There are also some "transitive" vendor dependencies; the _distutils package itself has a _vendor subpackage. As of 0f6ed20, released in setuptools 73.0, this folder contains a .dist-info folder for the packaging dependency; however, the macOS wheel only contain licenses files in the `_distutils/_vendor/packaging-24.0.dist-info folder. The WHEEL, RECORD, METADATA, INSTALLER and REQUESTED files have not been included in the wheel.

It's not clear what the intended behaviour is here. The inclusion of .dist-info folders may have been intentional; however, it's not immediately obvious to me that it is. AIUI, these dist-info packages can't be used by importib, as the _vendor subfolder isn't directly on the PYTHONPATH. The files in the _vendor folder are included in the manifest of the top-level setuptools package metadata, so they haven't been included to avoid that duplication.

If it was intentional, then the macOS wheels for 73.0+ are incomplete, as the distutils vendored version of packaging has an invalid .dist-info folder.

This problem was observed as beeware/briefcase#1970, which needs to do some post-install processing on installed dependencies. This involves looking for .dist-info folders to find content that need to be post-processed; this has historically been done with a **/*.dist-info glob. As a result, it found the _distutils/_vendor/packaging-24.0.dist-info folder, but then broke because it isn't a valid dist-info folder.

To be clear - this is also a bug in Briefcase, as we should only be looking for top-level dependencies. However, the inconsistent state of dist-info files in the published artefacts also seems like a possible bug.

Expected behavior

Either complete .dist-info packages for all vendored dependencies; or no .dist-info content in vendored dependencies.

How to Reproduce

Compare the setuptools/_distutil/_vendor/packaging-24.0.distinfo folder with the same content macOS wheels.

Output

Metadata

Metadata

Assignees

No one assigned

    Labels

    Needs TriageIssues that need to be evaluated for severity and status.bug

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions