|
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299 |
- """Routines related to PyPI, indexes"""
- from __future__ import absolute_import
-
- import logging
- import cgi
- from collections import namedtuple
- import itertools
- import sys
- import os
- import re
- import mimetypes
- import posixpath
- import warnings
-
- from pip._vendor.six.moves.urllib import parse as urllib_parse
- from pip._vendor.six.moves.urllib import request as urllib_request
-
- from pip.compat import ipaddress
- from pip.utils import (
- Inf, cached_property, normalize_name, splitext, normalize_path,
- ARCHIVE_EXTENSIONS, SUPPORTED_EXTENSIONS)
- from pip.utils.deprecation import RemovedInPip8Warning
- from pip.utils.logging import indent_log
- from pip.exceptions import (
- DistributionNotFound, BestVersionAlreadyInstalled, InvalidWheelFilename,
- UnsupportedWheel,
- )
- from pip.download import HAS_TLS, url_to_path, path_to_url
- from pip.models import PyPI
- from pip.wheel import Wheel, wheel_ext
- from pip.pep425tags import supported_tags, supported_tags_noarch, get_platform
- from pip._vendor import html5lib, requests, pkg_resources, six
- from pip._vendor.packaging.version import parse as parse_version
- from pip._vendor.requests.exceptions import SSLError
-
-
- __all__ = ['FormatControl', 'fmt_ctl_handle_mutual_exclude', 'PackageFinder']
-
-
- # Taken from Chrome's list of secure origins (See: http://bit.ly/1qrySKC)
- SECURE_ORIGINS = [
- # protocol, hostname, port
- ("https", "*", "*"),
- ("*", "localhost", "*"),
- ("*", "127.0.0.0/8", "*"),
- ("*", "::1/128", "*"),
- ("file", "*", None),
- ]
-
-
- logger = logging.getLogger(__name__)
-
-
- class InstallationCandidate(object):
-
- def __init__(self, project, version, location):
- self.project = project
- self.version = parse_version(version)
- self.location = location
- self._key = (self.project, self.version, self.location)
-
- def __repr__(self):
- return "<InstallationCandidate({0!r}, {1!r}, {2!r})>".format(
- self.project, self.version, self.location,
- )
-
- def __hash__(self):
- return hash(self._key)
-
- def __lt__(self, other):
- return self._compare(other, lambda s, o: s < o)
-
- def __le__(self, other):
- return self._compare(other, lambda s, o: s <= o)
-
- def __eq__(self, other):
- return self._compare(other, lambda s, o: s == o)
-
- def __ge__(self, other):
- return self._compare(other, lambda s, o: s >= o)
-
- def __gt__(self, other):
- return self._compare(other, lambda s, o: s > o)
-
- def __ne__(self, other):
- return self._compare(other, lambda s, o: s != o)
-
- def _compare(self, other, method):
- if not isinstance(other, InstallationCandidate):
- return NotImplemented
-
- return method(self._key, other._key)
-
-
- class PackageFinder(object):
- """This finds packages.
-
- This is meant to match easy_install's technique for looking for
- packages, by reading pages and looking for appropriate links.
- """
-
- def __init__(self, find_links, index_urls,
- allow_external=(), allow_unverified=(),
- allow_all_external=False, allow_all_prereleases=False,
- trusted_hosts=None, process_dependency_links=False,
- session=None, format_control=None):
- """Create a PackageFinder.
-
- :param format_control: A FormatControl object or None. Used to control
- the selection of source packages / binary packages when consulting
- the index and links.
- """
- if session is None:
- raise TypeError(
- "PackageFinder() missing 1 required keyword argument: "
- "'session'"
- )
-
- # Build find_links. If an argument starts with ~, it may be
- # a local file relative to a home directory. So try normalizing
- # it and if it exists, use the normalized version.
- # This is deliberately conservative - it might be fine just to
- # blindly normalize anything starting with a ~...
- self.find_links = []
- for link in find_links:
- if link.startswith('~'):
- new_link = normalize_path(link)
- if os.path.exists(new_link):
- link = new_link
- self.find_links.append(link)
-
- self.index_urls = index_urls
- self.dependency_links = []
-
- # These are boring links that have already been logged somehow:
- self.logged_links = set()
-
- self.format_control = format_control or FormatControl(set(), set())
-
- # Do we allow (safe and verifiable) externally hosted files?
- self.allow_external = set(normalize_name(n) for n in allow_external)
-
- # Which names are allowed to install insecure and unverifiable files?
- self.allow_unverified = set(
- normalize_name(n) for n in allow_unverified
- )
-
- # Anything that is allowed unverified is also allowed external
- self.allow_external |= self.allow_unverified
-
- # Do we allow all (safe and verifiable) externally hosted files?
- self.allow_all_external = allow_all_external
-
- # Domains that we won't emit warnings for when not using HTTPS
- self.secure_origins = [
- ("*", host, "*")
- for host in (trusted_hosts if trusted_hosts else [])
- ]
-
- # Stores if we ignored any external links so that we can instruct
- # end users how to install them if no distributions are available
- self.need_warn_external = False
-
- # Stores if we ignored any unsafe links so that we can instruct
- # end users how to install them if no distributions are available
- self.need_warn_unverified = False
-
- # Do we want to allow _all_ pre-releases?
- self.allow_all_prereleases = allow_all_prereleases
-
- # Do we process dependency links?
- self.process_dependency_links = process_dependency_links
-
- # The Session we'll use to make requests
- self.session = session
-
- # If we don't have TLS enabled, then WARN if anyplace we're looking
- # relies on TLS.
- if not HAS_TLS:
- for link in itertools.chain(self.index_urls, self.find_links):
- parsed = urllib_parse.urlparse(link)
- if parsed.scheme == "https":
- logger.warning(
- "pip is configured with locations that require "
- "TLS/SSL, however the ssl module in Python is not "
- "available."
- )
- break
-
- def add_dependency_links(self, links):
- # # FIXME: this shouldn't be global list this, it should only
- # # apply to requirements of the package that specifies the
- # # dependency_links value
- # # FIXME: also, we should track comes_from (i.e., use Link)
- if self.process_dependency_links:
- warnings.warn(
- "Dependency Links processing has been deprecated and will be "
- "removed in a future release.",
- RemovedInPip8Warning,
- )
- self.dependency_links.extend(links)
-
- @staticmethod
- def _sort_locations(locations, expand_dir=False):
- """
- Sort locations into "files" (archives) and "urls", and return
- a pair of lists (files,urls)
- """
- files = []
- urls = []
-
- # puts the url for the given file path into the appropriate list
- def sort_path(path):
- url = path_to_url(path)
- if mimetypes.guess_type(url, strict=False)[0] == 'text/html':
- urls.append(url)
- else:
- files.append(url)
-
- for url in locations:
-
- is_local_path = os.path.exists(url)
- is_file_url = url.startswith('file:')
-
- if is_local_path or is_file_url:
- if is_local_path:
- path = url
- else:
- path = url_to_path(url)
- if os.path.isdir(path):
- if expand_dir:
- path = os.path.realpath(path)
- for item in os.listdir(path):
- sort_path(os.path.join(path, item))
- elif is_file_url:
- urls.append(url)
- elif os.path.isfile(path):
- sort_path(path)
- else:
- urls.append(url)
-
- return files, urls
-
- def _candidate_sort_key(self, candidate):
- """
- Function used to generate link sort key for link tuples.
- The greater the return value, the more preferred it is.
- If not finding wheels, then sorted by version only.
- If finding wheels, then the sort order is by version, then:
- 1. existing installs
- 2. wheels ordered via Wheel.support_index_min()
- 3. source archives
- Note: it was considered to embed this logic into the Link
- comparison operators, but then different sdist links
- with the same version, would have to be considered equal
- """
- support_num = len(supported_tags)
- if candidate.location == INSTALLED_VERSION:
- pri = 1
- elif candidate.location.is_wheel:
- # can raise InvalidWheelFilename
- wheel = Wheel(candidate.location.filename)
- if not wheel.supported():
- raise UnsupportedWheel(
- "%s is not a supported wheel for this platform. It "
- "can't be sorted." % wheel.filename
- )
- pri = -(wheel.support_index_min())
- else: # sdist
- pri = -(support_num)
- return (candidate.version, pri)
-
- def _sort_versions(self, applicable_versions):
- """
- Bring the latest version (and wheels) to the front, but maintain the
- existing ordering as secondary. See the docstring for `_link_sort_key`
- for details. This function is isolated for easier unit testing.
- """
- return sorted(
- applicable_versions,
- key=self._candidate_sort_key,
- reverse=True
- )
-
- def _validate_secure_origin(self, logger, location):
- # Determine if this url used a secure transport mechanism
- parsed = urllib_parse.urlparse(str(location))
- origin = (parsed.scheme, parsed.hostname, parsed.port)
-
- # Determine if our origin is a secure origin by looking through our
- # hardcoded list of secure origins, as well as any additional ones
- # configured on this PackageFinder instance.
- for secure_origin in (SECURE_ORIGINS + self.secure_origins):
- # Check to see if the protocol matches
- if origin[0] != secure_origin[0] and secure_origin[0] != "*":
- continue
-
- try:
- # We need to do this decode dance to ensure that we have a
- # unicode object, even on Python 2.x.
- addr = ipaddress.ip_address(
- origin[1]
- if (
- isinstance(origin[1], six.text_type) or
- origin[1] is None
- )
- else origin[1].decode("utf8")
- )
- network = ipaddress.ip_network(
- secure_origin[1]
- if isinstance(secure_origin[1], six.text_type)
- else secure_origin[1].decode("utf8")
- )
- except ValueError:
- # We don't have both a valid address or a valid network, so
- # we'll check this origin against hostnames.
- if origin[1] != secure_origin[1] and secure_origin[1] != "*":
- continue
- else:
- # We have a valid address and network, so see if the address
- # is contained within the network.
- if addr not in network:
- continue
-
- # Check to see if the port patches
- if (origin[2] != secure_origin[2] and
- secure_origin[2] != "*" and
- secure_origin[2] is not None):
- continue
-
- # If we've gotten here, then this origin matches the current
- # secure origin and we should return True
- return True
-
- # If we've gotten to this point, then the origin isn't secure and we
- # will not accept it as a valid location to search. We will however
- # log a warning that we are ignoring it.
- logger.warning(
- "The repository located at %s is not a trusted or secure host and "
- "is being ignored. If this repository is available via HTTPS it "
- "is recommended to use HTTPS instead, otherwise you may silence "
- "this warning and allow it anyways with '--trusted-host %s'.",
- parsed.hostname,
- parsed.hostname,
- )
-
- return False
-
- def _get_index_urls_locations(self, project_name):
- """Returns the locations found via self.index_urls
-
- Checks the url_name on the main (first in the list) index and
- use this url_name to produce all locations
- """
-
- def mkurl_pypi_url(url):
- loc = posixpath.join(url, project_url_name)
- # For maximum compatibility with easy_install, ensure the path
- # ends in a trailing slash. Although this isn't in the spec
- # (and PyPI can handle it without the slash) some other index
- # implementations might break if they relied on easy_install's
- # behavior.
- if not loc.endswith('/'):
- loc = loc + '/'
- return loc
-
- project_url_name = urllib_parse.quote(project_name.lower())
-
- if self.index_urls:
- # Check that we have the url_name correctly spelled:
-
- # Only check main index if index URL is given
- main_index_url = Link(
- mkurl_pypi_url(self.index_urls[0]),
- trusted=True,
- )
-
- page = self._get_page(main_index_url)
- if page is None and PyPI.netloc not in str(main_index_url):
- warnings.warn(
- "Failed to find %r at %s. It is suggested to upgrade "
- "your index to support normalized names as the name in "
- "/simple/{name}." % (project_name, main_index_url),
- RemovedInPip8Warning,
- )
-
- project_url_name = self._find_url_name(
- Link(self.index_urls[0], trusted=True),
- project_url_name,
- ) or project_url_name
-
- if project_url_name is not None:
- return [mkurl_pypi_url(url) for url in self.index_urls]
- return []
-
- def _find_all_versions(self, project_name):
- """Find all available versions for project_name
-
- This checks index_urls, find_links and dependency_links
- All versions found are returned
-
- See _link_package_versions for details on which files are accepted
- """
- index_locations = self._get_index_urls_locations(project_name)
- index_file_loc, index_url_loc = self._sort_locations(index_locations)
- fl_file_loc, fl_url_loc = self._sort_locations(
- self.find_links, expand_dir=True)
- dep_file_loc, dep_url_loc = self._sort_locations(self.dependency_links)
-
- file_locations = (
- Link(url) for url in itertools.chain(
- index_file_loc, fl_file_loc, dep_file_loc)
- )
-
- # We trust every url that the user has given us whether it was given
- # via --index-url or --find-links
- # We explicitly do not trust links that came from dependency_links
- # We want to filter out any thing which does not have a secure origin.
- url_locations = [
- link for link in itertools.chain(
- (Link(url, trusted=True) for url in index_url_loc),
- (Link(url, trusted=True) for url in fl_url_loc),
- (Link(url) for url in dep_url_loc),
- )
- if self._validate_secure_origin(logger, link)
- ]
-
- logger.debug('%d location(s) to search for versions of %s:',
- len(url_locations), project_name)
-
- for location in url_locations:
- logger.debug('* %s', location)
-
- canonical_name = pkg_resources.safe_name(project_name).lower()
- formats = fmt_ctl_formats(self.format_control, canonical_name)
- search = Search(project_name.lower(), canonical_name, formats)
- find_links_versions = self._package_versions(
- # We trust every directly linked archive in find_links
- (Link(url, '-f', trusted=True) for url in self.find_links),
- search
- )
-
- page_versions = []
- for page in self._get_pages(url_locations, project_name):
- logger.debug('Analyzing links from page %s', page.url)
- with indent_log():
- page_versions.extend(
- self._package_versions(page.links, search)
- )
-
- dependency_versions = self._package_versions(
- (Link(url) for url in self.dependency_links), search
- )
- if dependency_versions:
- logger.debug(
- 'dependency_links found: %s',
- ', '.join([
- version.location.url for version in dependency_versions
- ])
- )
-
- file_versions = self._package_versions(file_locations, search)
- if file_versions:
- file_versions.sort(reverse=True)
- logger.debug(
- 'Local files found: %s',
- ', '.join([
- url_to_path(candidate.location.url)
- for candidate in file_versions
- ])
- )
-
- # This is an intentional priority ordering
- return (
- file_versions + find_links_versions + page_versions +
- dependency_versions
- )
-
- def find_requirement(self, req, upgrade):
- """Try to find an InstallationCandidate for req
-
- Expects req, an InstallRequirement and upgrade, a boolean
- Returns an InstallationCandidate or None
- May raise DistributionNotFound or BestVersionAlreadyInstalled
- """
- all_versions = self._find_all_versions(req.name)
-
- # Filter out anything which doesn't match our specifier
- _versions = set(
- req.specifier.filter(
- # We turn the version object into a str here because otherwise
- # when we're debundled but setuptools isn't, Python will see
- # packaging.version.Version and
- # pkg_resources._vendor.packaging.version.Version as different
- # types. This way we'll use a str as a common data interchange
- # format. If we stop using the pkg_resources provided specifier
- # and start using our own, we can drop the cast to str().
- [str(x.version) for x in all_versions],
- prereleases=(
- self.allow_all_prereleases
- if self.allow_all_prereleases else None
- ),
- )
- )
- applicable_versions = [
- # Again, converting to str to deal with debundling.
- x for x in all_versions if str(x.version) in _versions
- ]
-
- if req.satisfied_by is not None:
- # Finally add our existing versions to the front of our versions.
- applicable_versions.insert(
- 0,
- InstallationCandidate(
- req.name,
- req.satisfied_by.version,
- INSTALLED_VERSION,
- )
- )
- existing_applicable = True
- else:
- existing_applicable = False
-
- applicable_versions = self._sort_versions(applicable_versions)
-
- if not upgrade and existing_applicable:
- if applicable_versions[0].location is INSTALLED_VERSION:
- logger.debug(
- 'Existing installed version (%s) is most up-to-date and '
- 'satisfies requirement',
- req.satisfied_by.version,
- )
- else:
- logger.debug(
- 'Existing installed version (%s) satisfies requirement '
- '(most up-to-date version is %s)',
- req.satisfied_by.version,
- applicable_versions[0][2],
- )
- return None
-
- if not applicable_versions:
- logger.critical(
- 'Could not find a version that satisfies the requirement %s '
- '(from versions: %s)',
- req,
- ', '.join(
- sorted(
- set(str(i.version) for i in all_versions),
- key=parse_version,
- )
- )
- )
-
- if self.need_warn_external:
- logger.warning(
- "Some externally hosted files were ignored as access to "
- "them may be unreliable (use --allow-external %s to "
- "allow).",
- req.name,
- )
-
- if self.need_warn_unverified:
- logger.warning(
- "Some insecure and unverifiable files were ignored"
- " (use --allow-unverified %s to allow).",
- req.name,
- )
-
- raise DistributionNotFound(
- 'No matching distribution found for %s' % req
- )
-
- if applicable_versions[0].location is INSTALLED_VERSION:
- # We have an existing version, and its the best version
- logger.debug(
- 'Installed version (%s) is most up-to-date (past versions: '
- '%s)',
- req.satisfied_by.version,
- ', '.join(str(i.version) for i in applicable_versions[1:]) or
- "none",
- )
- raise BestVersionAlreadyInstalled
-
- if len(applicable_versions) > 1:
- logger.debug(
- 'Using version %s (newest of versions: %s)',
- applicable_versions[0].version,
- ', '.join(str(i.version) for i in applicable_versions)
- )
-
- selected_version = applicable_versions[0].location
-
- if (selected_version.verifiable is not None and not
- selected_version.verifiable):
- logger.warning(
- "%s is potentially insecure and unverifiable.", req.name,
- )
-
- return selected_version
-
- def _find_url_name(self, index_url, url_name):
- """
- Finds the true URL name of a package, when the given name isn't quite
- correct.
- This is usually used to implement case-insensitivity.
- """
- if not index_url.url.endswith('/'):
- # Vaguely part of the PyPI API... weird but true.
- # FIXME: bad to modify this?
- index_url.url += '/'
- page = self._get_page(index_url)
- if page is None:
- logger.critical('Cannot fetch index base URL %s', index_url)
- return
- norm_name = normalize_name(url_name)
- for link in page.links:
- base = posixpath.basename(link.path.rstrip('/'))
- if norm_name == normalize_name(base):
- logger.debug(
- 'Real name of requirement %s is %s', url_name, base,
- )
- return base
- return None
-
- def _get_pages(self, locations, project_name):
- """
- Yields (page, page_url) from the given locations, skipping
- locations that have errors, and adding download/homepage links
- """
- all_locations = list(locations)
- seen = set()
- normalized = normalize_name(project_name)
-
- while all_locations:
- location = all_locations.pop(0)
- if location in seen:
- continue
- seen.add(location)
-
- page = self._get_page(location)
- if page is None:
- continue
-
- yield page
-
- for link in page.rel_links():
-
- if (normalized not in self.allow_external and not
- self.allow_all_external):
- self.need_warn_external = True
- logger.debug(
- "Not searching %s for files because external "
- "urls are disallowed.",
- link,
- )
- continue
-
- if (link.trusted is not None and not
- link.trusted and
- normalized not in self.allow_unverified):
- logger.debug(
- "Not searching %s for urls, it is an "
- "untrusted link and cannot produce safe or "
- "verifiable files.",
- link,
- )
- self.need_warn_unverified = True
- continue
-
- all_locations.append(link)
-
- _py_version_re = re.compile(r'-py([123]\.?[0-9]?)$')
-
- def _sort_links(self, links):
- """
- Returns elements of links in order, non-egg links first, egg links
- second, while eliminating duplicates
- """
- eggs, no_eggs = [], []
- seen = set()
- for link in links:
- if link not in seen:
- seen.add(link)
- if link.egg_fragment:
- eggs.append(link)
- else:
- no_eggs.append(link)
- return no_eggs + eggs
-
- def _package_versions(self, links, search):
- result = []
- for link in self._sort_links(links):
- v = self._link_package_versions(link, search)
- if v is not None:
- result.append(v)
- return result
-
- def _log_skipped_link(self, link, reason):
- if link not in self.logged_links:
- logger.debug('Skipping link %s; %s', link, reason)
- self.logged_links.add(link)
-
- def _link_package_versions(self, link, search):
- """Return an InstallationCandidate or None"""
- platform = get_platform()
-
- version = None
- if link.egg_fragment:
- egg_info = link.egg_fragment
- ext = link.ext
- else:
- egg_info, ext = link.splitext()
- if not ext:
- self._log_skipped_link(link, 'not a file')
- return
- if ext not in SUPPORTED_EXTENSIONS:
- self._log_skipped_link(
- link, 'unsupported archive format: %s' % ext)
- return
- if "binary" not in search.formats and ext == wheel_ext:
- self._log_skipped_link(
- link, 'No binaries permitted for %s' % search.supplied)
- return
- if "macosx10" in link.path and ext == '.zip':
- self._log_skipped_link(link, 'macosx10 one')
- return
- if ext == wheel_ext:
- try:
- wheel = Wheel(link.filename)
- except InvalidWheelFilename:
- self._log_skipped_link(link, 'invalid wheel filename')
- return
- if (pkg_resources.safe_name(wheel.name).lower() !=
- search.canonical):
- self._log_skipped_link(
- link, 'wrong project name (not %s)' % search.supplied)
- return
- if not wheel.supported():
- self._log_skipped_link(
- link, 'it is not compatible with this Python')
- return
- # This is a dirty hack to prevent installing Binary Wheels from
- # PyPI unless it is a Windows or Mac Binary Wheel. This is
- # paired with a change to PyPI disabling uploads for the
- # same. Once we have a mechanism for enabling support for
- # binary wheels on linux that deals with the inherent problems
- # of binary distribution this can be removed.
- comes_from = getattr(link, "comes_from", None)
- if (
- (
- not platform.startswith('win') and not
- platform.startswith('macosx') and not
- platform == 'cli'
- ) and
- comes_from is not None and
- urllib_parse.urlparse(
- comes_from.url
- ).netloc.endswith(PyPI.netloc)):
- if not wheel.supported(tags=supported_tags_noarch):
- self._log_skipped_link(
- link,
- "it is a pypi-hosted binary "
- "Wheel on an unsupported platform",
- )
- return
- version = wheel.version
-
- # This should be up by the search.ok_binary check, but see issue 2700.
- if "source" not in search.formats and ext != wheel_ext:
- self._log_skipped_link(
- link, 'No sources permitted for %s' % search.supplied)
- return
-
- if not version:
- version = egg_info_matches(egg_info, search.supplied, link)
- if version is None:
- self._log_skipped_link(
- link, 'wrong project name (not %s)' % search.supplied)
- return
-
- if (link.internal is not None and not
- link.internal and not
- normalize_name(search.supplied).lower()
- in self.allow_external and not
- self.allow_all_external):
- # We have a link that we are sure is external, so we should skip
- # it unless we are allowing externals
- self._log_skipped_link(link, 'it is externally hosted')
- self.need_warn_external = True
- return
-
- if (link.verifiable is not None and not
- link.verifiable and not
- (normalize_name(search.supplied).lower()
- in self.allow_unverified)):
- # We have a link that we are sure we cannot verify its integrity,
- # so we should skip it unless we are allowing unsafe installs
- # for this requirement.
- self._log_skipped_link(
- link, 'it is an insecure and unverifiable file')
- self.need_warn_unverified = True
- return
-
- match = self._py_version_re.search(version)
- if match:
- version = version[:match.start()]
- py_version = match.group(1)
- if py_version != sys.version[:3]:
- self._log_skipped_link(
- link, 'Python version is incorrect')
- return
- logger.debug('Found link %s, version: %s', link, version)
-
- return InstallationCandidate(search.supplied, version, link)
-
- def _get_page(self, link):
- return HTMLPage.get_page(link, session=self.session)
-
-
- def egg_info_matches(
- egg_info, search_name, link,
- _egg_info_re=re.compile(r'([a-z0-9_.]+)-([a-z0-9_.!+-]+)', re.I)):
- """Pull the version part out of a string.
-
- :param egg_info: The string to parse. E.g. foo-2.1
- :param search_name: The name of the package this belongs to. None to
- infer the name. Note that this cannot unambiguously parse strings
- like foo-2-2 which might be foo, 2-2 or foo-2, 2.
- :param link: The link the string came from, for logging on failure.
- """
- match = _egg_info_re.search(egg_info)
- if not match:
- logger.debug('Could not parse version from link: %s', link)
- return None
- if search_name is None:
- full_match = match.group(0)
- return full_match[full_match.index('-'):]
- name = match.group(0).lower()
- # To match the "safe" name that pkg_resources creates:
- name = name.replace('_', '-')
- # project name and version must be separated by a dash
- look_for = search_name.lower() + "-"
- if name.startswith(look_for):
- return match.group(0)[len(look_for):]
- else:
- return None
-
-
- class HTMLPage(object):
- """Represents one page, along with its URL"""
-
- def __init__(self, content, url, headers=None, trusted=None):
- # Determine if we have any encoding information in our headers
- encoding = None
- if headers and "Content-Type" in headers:
- content_type, params = cgi.parse_header(headers["Content-Type"])
-
- if "charset" in params:
- encoding = params['charset']
-
- self.content = content
- self.parsed = html5lib.parse(
- self.content,
- encoding=encoding,
- namespaceHTMLElements=False,
- )
- self.url = url
- self.headers = headers
- self.trusted = trusted
-
- def __str__(self):
- return self.url
-
- @classmethod
- def get_page(cls, link, skip_archives=True, session=None):
- if session is None:
- raise TypeError(
- "get_page() missing 1 required keyword argument: 'session'"
- )
-
- url = link.url
- url = url.split('#', 1)[0]
-
- # Check for VCS schemes that do not support lookup as web pages.
- from pip.vcs import VcsSupport
- for scheme in VcsSupport.schemes:
- if url.lower().startswith(scheme) and url[len(scheme)] in '+:':
- logger.debug('Cannot look at %s URL %s', scheme, link)
- return None
-
- try:
- if skip_archives:
- filename = link.filename
- for bad_ext in ARCHIVE_EXTENSIONS:
- if filename.endswith(bad_ext):
- content_type = cls._get_content_type(
- url, session=session,
- )
- if content_type.lower().startswith('text/html'):
- break
- else:
- logger.debug(
- 'Skipping page %s because of Content-Type: %s',
- link,
- content_type,
- )
- return
-
- logger.debug('Getting page %s', url)
-
- # Tack index.html onto file:// URLs that point to directories
- (scheme, netloc, path, params, query, fragment) = \
- urllib_parse.urlparse(url)
- if (scheme == 'file' and
- os.path.isdir(urllib_request.url2pathname(path))):
- # add trailing slash if not present so urljoin doesn't trim
- # final segment
- if not url.endswith('/'):
- url += '/'
- url = urllib_parse.urljoin(url, 'index.html')
- logger.debug(' file: URL is directory, getting %s', url)
-
- resp = session.get(
- url,
- headers={
- "Accept": "text/html",
- "Cache-Control": "max-age=600",
- },
- )
- resp.raise_for_status()
-
- # The check for archives above only works if the url ends with
- # something that looks like an archive. However that is not a
- # requirement of an url. Unless we issue a HEAD request on every
- # url we cannot know ahead of time for sure if something is HTML
- # or not. However we can check after we've downloaded it.
- content_type = resp.headers.get('Content-Type', 'unknown')
- if not content_type.lower().startswith("text/html"):
- logger.debug(
- 'Skipping page %s because of Content-Type: %s',
- link,
- content_type,
- )
- return
-
- inst = cls(
- resp.content, resp.url, resp.headers,
- trusted=link.trusted,
- )
- except requests.HTTPError as exc:
- level = 2 if exc.response.status_code == 404 else 1
- cls._handle_fail(link, exc, url, level=level)
- except requests.ConnectionError as exc:
- cls._handle_fail(link, "connection error: %s" % exc, url)
- except requests.Timeout:
- cls._handle_fail(link, "timed out", url)
- except SSLError as exc:
- reason = ("There was a problem confirming the ssl certificate: "
- "%s" % exc)
- cls._handle_fail(link, reason, url, level=2, meth=logger.info)
- else:
- return inst
-
- @staticmethod
- def _handle_fail(link, reason, url, level=1, meth=None):
- if meth is None:
- meth = logger.debug
-
- meth("Could not fetch URL %s: %s - skipping", link, reason)
-
- @staticmethod
- def _get_content_type(url, session):
- """Get the Content-Type of the given url, using a HEAD request"""
- scheme, netloc, path, query, fragment = urllib_parse.urlsplit(url)
- if scheme not in ('http', 'https'):
- # FIXME: some warning or something?
- # assertion error?
- return ''
-
- resp = session.head(url, allow_redirects=True)
- resp.raise_for_status()
-
- return resp.headers.get("Content-Type", "")
-
- @cached_property
- def api_version(self):
- metas = [
- x for x in self.parsed.findall(".//meta")
- if x.get("name", "").lower() == "api-version"
- ]
- if metas:
- try:
- return int(metas[0].get("value", None))
- except (TypeError, ValueError):
- pass
-
- return None
-
- @cached_property
- def base_url(self):
- bases = [
- x for x in self.parsed.findall(".//base")
- if x.get("href") is not None
- ]
- if bases and bases[0].get("href"):
- return bases[0].get("href")
- else:
- return self.url
-
- @property
- def links(self):
- """Yields all links in the page"""
- for anchor in self.parsed.findall(".//a"):
- if anchor.get("href"):
- href = anchor.get("href")
- url = self.clean_link(
- urllib_parse.urljoin(self.base_url, href)
- )
-
- # Determine if this link is internal. If that distinction
- # doesn't make sense in this context, then we don't make
- # any distinction.
- internal = None
- if self.api_version and self.api_version >= 2:
- # Only api_versions >= 2 have a distinction between
- # external and internal links
- internal = bool(
- anchor.get("rel") and
- "internal" in anchor.get("rel").split()
- )
-
- yield Link(url, self, internal=internal)
-
- def rel_links(self, rels=('homepage', 'download')):
- """Yields all links with the given relations"""
- rels = set(rels)
-
- for anchor in self.parsed.findall(".//a"):
- if anchor.get("rel") and anchor.get("href"):
- found_rels = set(anchor.get("rel").split())
- # Determine the intersection between what rels were found and
- # what rels were being looked for
- if found_rels & rels:
- href = anchor.get("href")
- url = self.clean_link(
- urllib_parse.urljoin(self.base_url, href)
- )
- yield Link(url, self, trusted=False)
-
- _clean_re = re.compile(r'[^a-z0-9$&+,/:;=?@.#%_\\|-]', re.I)
-
- def clean_link(self, url):
- """Makes sure a link is fully encoded. That is, if a ' ' shows up in
- the link, it will be rewritten to %20 (while not over-quoting
- % or other characters)."""
- return self._clean_re.sub(
- lambda match: '%%%2x' % ord(match.group(0)), url)
-
-
- class Link(object):
-
- def __init__(self, url, comes_from=None, internal=None, trusted=None):
-
- # url can be a UNC windows share
- if url != Inf and url.startswith('\\\\'):
- url = path_to_url(url)
-
- self.url = url
- self.comes_from = comes_from
- self.internal = internal
- self.trusted = trusted
-
- def __str__(self):
- if self.comes_from:
- return '%s (from %s)' % (self.url, self.comes_from)
- else:
- return str(self.url)
-
- def __repr__(self):
- return '<Link %s>' % self
-
- def __eq__(self, other):
- if not isinstance(other, Link):
- return NotImplemented
- return self.url == other.url
-
- def __ne__(self, other):
- if not isinstance(other, Link):
- return NotImplemented
- return self.url != other.url
-
- def __lt__(self, other):
- if not isinstance(other, Link):
- return NotImplemented
- return self.url < other.url
-
- def __le__(self, other):
- if not isinstance(other, Link):
- return NotImplemented
- return self.url <= other.url
-
- def __gt__(self, other):
- if not isinstance(other, Link):
- return NotImplemented
- return self.url > other.url
-
- def __ge__(self, other):
- if not isinstance(other, Link):
- return NotImplemented
- return self.url >= other.url
-
- def __hash__(self):
- return hash(self.url)
-
- @property
- def filename(self):
- _, netloc, path, _, _ = urllib_parse.urlsplit(self.url)
- name = posixpath.basename(path.rstrip('/')) or netloc
- name = urllib_parse.unquote(name)
- assert name, ('URL %r produced no filename' % self.url)
- return name
-
- @property
- def scheme(self):
- return urllib_parse.urlsplit(self.url)[0]
-
- @property
- def netloc(self):
- return urllib_parse.urlsplit(self.url)[1]
-
- @property
- def path(self):
- return urllib_parse.unquote(urllib_parse.urlsplit(self.url)[2])
-
- def splitext(self):
- return splitext(posixpath.basename(self.path.rstrip('/')))
-
- @property
- def ext(self):
- return self.splitext()[1]
-
- @property
- def url_without_fragment(self):
- scheme, netloc, path, query, fragment = urllib_parse.urlsplit(self.url)
- return urllib_parse.urlunsplit((scheme, netloc, path, query, None))
-
- _egg_fragment_re = re.compile(r'#egg=([^&]*)')
-
- @property
- def egg_fragment(self):
- match = self._egg_fragment_re.search(self.url)
- if not match:
- return None
- return match.group(1)
-
- _hash_re = re.compile(
- r'(sha1|sha224|sha384|sha256|sha512|md5)=([a-f0-9]+)'
- )
-
- @property
- def hash(self):
- match = self._hash_re.search(self.url)
- if match:
- return match.group(2)
- return None
-
- @property
- def hash_name(self):
- match = self._hash_re.search(self.url)
- if match:
- return match.group(1)
- return None
-
- @property
- def show_url(self):
- return posixpath.basename(self.url.split('#', 1)[0].split('?', 1)[0])
-
- @property
- def verifiable(self):
- """
- Returns True if this link can be verified after download, False if it
- cannot, and None if we cannot determine.
- """
- trusted = self.trusted or getattr(self.comes_from, "trusted", None)
- if trusted is not None and trusted:
- # This link came from a trusted source. It *may* be verifiable but
- # first we need to see if this page is operating under the new
- # API version.
- try:
- api_version = getattr(self.comes_from, "api_version", None)
- api_version = int(api_version)
- except (ValueError, TypeError):
- api_version = None
-
- if api_version is None or api_version <= 1:
- # This link is either trusted, or it came from a trusted,
- # however it is not operating under the API version 2 so
- # we can't make any claims about if it's safe or not
- return
-
- if self.hash:
- # This link came from a trusted source and it has a hash, so we
- # can consider it safe.
- return True
- else:
- # This link came from a trusted source, using the new API
- # version, and it does not have a hash. It is NOT verifiable
- return False
- elif trusted is not None:
- # This link came from an untrusted source and we cannot trust it
- return False
-
- @property
- def is_wheel(self):
- return self.ext == wheel_ext
-
- @property
- def is_artifact(self):
- """
- Determines if this points to an actual artifact (e.g. a tarball) or if
- it points to an "abstract" thing like a path or a VCS location.
- """
- from pip.vcs import vcs
-
- if self.scheme in vcs.all_schemes:
- return False
-
- return True
-
-
- # An object to represent the "link" for the installed version of a requirement.
- # Using Inf as the url makes it sort higher.
- INSTALLED_VERSION = Link(Inf)
-
-
- FormatControl = namedtuple('FormatControl', 'no_binary only_binary')
- """This object has two fields, no_binary and only_binary.
-
- If a field is falsy, it isn't set. If it is {':all:'}, it should match all
- packages except those listed in the other field. Only one field can be set
- to {':all:'} at a time. The rest of the time exact package name matches
- are listed, with any given package only showing up in one field at a time.
- """
-
-
- def fmt_ctl_handle_mutual_exclude(value, target, other):
- new = value.split(',')
- while ':all:' in new:
- other.clear()
- target.clear()
- target.add(':all:')
- del new[:new.index(':all:') + 1]
- if ':none:' not in new:
- # Without a none, we want to discard everything as :all: covers it
- return
- for name in new:
- if name == ':none:':
- target.clear()
- continue
- name = pkg_resources.safe_name(name).lower()
- other.discard(name)
- target.add(name)
-
-
- def fmt_ctl_formats(fmt_ctl, canonical_name):
- result = set(["binary", "source"])
- if canonical_name in fmt_ctl.only_binary:
- result.discard('source')
- elif canonical_name in fmt_ctl.no_binary:
- result.discard('binary')
- elif ':all:' in fmt_ctl.only_binary:
- result.discard('source')
- elif ':all:' in fmt_ctl.no_binary:
- result.discard('binary')
- return frozenset(result)
-
-
- def fmt_ctl_no_binary(fmt_ctl):
- fmt_ctl_handle_mutual_exclude(
- ':all:', fmt_ctl.no_binary, fmt_ctl.only_binary)
-
-
- def fmt_ctl_no_use_wheel(fmt_ctl):
- fmt_ctl_no_binary(fmt_ctl)
- warnings.warn(
- '--no-use-wheel is deprecated and will be removed in the future. '
- ' Please use --no-binary :all: instead.', DeprecationWarning,
- stacklevel=2)
-
-
- Search = namedtuple('Search', 'supplied canonical formats')
- """Capture key aspects of a search.
-
- :attribute supplied: The user supplied package.
- :attribute canonical: The canonical package name.
- :attribute formats: The formats allowed for this package. Should be a set
- with 'binary' or 'source' or both in it.
- """
|