@@ -28,13 +28,13 @@ name "must be a valid Python identifier".
28
28
letter, digit, or any one of ``. ``, ``- ``, or ``_ `` after the initial character.
29
29
Otherwise, there is no other `PyPA specification
30
30
<https://packaging.python.org/en/latest/specifications/> `_
31
- which outlines how extra names should be written or normalization for comparison.
31
+ which outlines how extra names should be written or normalized for comparison.
32
32
Due to the amount of packaging-related code in existence,
33
33
it is important to evaluate current practices by the community and
34
- standardize on one that doesn't break most code, while being
34
+ standardize on one that doesn't break most existing code, while being
35
35
something tool authors can agree to following.
36
36
37
- The issue of there being no standard was brought forward by an
37
+ The issue of there being no consistent standard was brought forward by an
38
38
`initial discussion <https://discuss.python.org/t/7614 >`__
39
39
noting that the extra ``adhoc-ssl `` was not considered equal to the name
40
40
``adhoc_ssl `` by pip 22.
@@ -47,21 +47,23 @@ Rationale
47
47
48
48
re.sub(r"[-_.]+", "-", name).lower()
49
49
50
- This collapses any run of the substitution character down to a single
51
- character,
52
- e.g. ``--- `` gets collapsed down to ``- ``.
53
- This does **not ** produce a valid Python identifier as specified by
50
+ This collapses any run of the characters `` - ``, `` _ `` and `` . ``
51
+ down to a single `` - ``.
52
+ For example, ``--- `` `` . `` and `` __ `` all get converted to just ``- ``.
53
+ This does **not ** produce a valid Python identifier, per
54
54
the core metadata 2.2 specification for extra names.
55
55
56
- `Setuptools 60 does normalization <https://github.com/pypa/setuptools/blob/b2f7b8f92725c63b164d5776f85e67cc560def4e/pkg_resources/__init__.py#L1324-L1330 >`__
56
+ `Setuptools 60 performs normalization <https://github.com/pypa/setuptools/blob/b2f7b8f92725c63b164d5776f85e67cc560def4e/pkg_resources/__init__.py#L1324-L1330 >`__
57
57
via::
58
58
59
59
re.sub(r'[^A-Za-z0-9-.]+', '_', name).lower()
60
60
61
- The use of an underscore/``_ `` differs from PEP 503's use of a
62
- hyphen/``- ``.
63
- Runs of ``. `` and ``- ``, unlike PEP 503, do **not ** get collapsed,
64
- e.g. ``.. `` stays the same.
61
+ The use of an underscore/``_ `` differs from PEP 503's use of a hyphen/``- ``,
62
+ and it also normalizes characters outside of those allowed by :pep`508`.
63
+ Runs of ``. `` and ``- ``, unlike PEP 503, do **not ** get normalized to one ``_ ``,
64
+ e.g. ``.. `` stays the same. To note, this is inconsistent with this function's
65
+ docstring, which *does * specify that all non-alphanumeric characters
66
+ (which would include ``- `` and ``. ``) are normalized and collapsed.
65
67
66
68
For pip 22, its
67
69
`"extra normalisation behaviour is quite convoluted and erratic" <pip-erratic _>`__,
@@ -96,7 +98,7 @@ name is provided as appropriate for the specified core metadata version.
96
98
If an older core metadata version is specified and the name would be
97
99
invalid with newer core metadata versions,
98
100
tools SHOULD warn the user.
99
- Tools SHOULD warn users when an invalid extra name is read and not use
101
+ Tools SHOULD warn users when an invalid extra name is read and SHOULD not use
100
102
the name to avoid ambiguity.
101
103
Tools MAY raise an error instead of a warning when reading an
102
104
invalid name, if they so desire.
@@ -105,21 +107,20 @@ invalid name, if they so desire.
105
107
Backwards Compatibility
106
108
=======================
107
109
108
- Moving to :pep: `503 ` normalization and :pep: `508 ` name acceptance, it
110
+ Moving to :pep: `503 ` normalization and :pep: `508 ` name acceptance,
109
111
allows for all preexisting, valid names to continue to be valid.
110
112
111
113
Based on `research looking at a collection of wheels on PyPI <pypi-results _>`__,
112
- the risk of extra name clashes is limited to 73 clashes when considering
113
- even invalid names,
114
+ the risk of extra name clashes is limited to 73 instances when considering
115
+ all extras names on PyPI, valid or not (not just those within a single package)
114
116
while *only * looking at valid names leads to only 3 clashes:
115
117
116
118
* ``dev-test ``: ``dev_test ``, ``dev-test ``, ``dev.test ``
117
119
* ``dev-lint ``: ``dev-lint ``, ``dev.lint ``, ``dev_lint ``
118
120
* ``apache-beam ``: ``apache-beam ``, ``apache.beam ``
119
121
120
122
By requiring tools writing core metadata to only record the normalized name,
121
- the issue of preexisting, invalid extra names should be diminished over
122
- time.
123
+ the issue of preexisting, invalid extra names should diminish over time.
123
124
124
125
.. _pypi-results : https://discuss.python.org/t/14141/17
125
126
@@ -128,7 +129,7 @@ Security Implications
128
129
=====================
129
130
130
131
It is possible that for a distribution that has conflicting extra names, a
131
- tool ends up installing distributions that somehow weaken the security
132
+ tool ends up installing dependencies that somehow weaken the security
132
133
of the system.
133
134
This is only hypothetical and if it were to occur,
134
135
it would probably be more of a security concern for the distributions
@@ -149,7 +150,7 @@ Reference Implementation
149
150
150
151
No reference implementation is provided aside from the code above,
151
152
but the expectation is the `packaging project `_ will provide a
152
- function in its ``packaging.utils `` that will implement extra name
153
+ function in its ``packaging.utils `` module that will implement extra name
153
154
normalization.
154
155
It will also implement extra name comparisons appropriately.
155
156
Finally, if the project ever gains the ability to write out metadata,
@@ -162,17 +163,12 @@ Rejected Ideas
162
163
Using setuptools 60's normalization
163
164
-----------------------------------
164
165
165
- Initially, this PEP proposed following setuptools to try to minimize
166
- backwards-compatibility issues.
167
- But after checking various wheels on PyPI,
166
+ Initially, this PEP proposed using setuptools `` safe_extra() `` for normalization
167
+ to try to minimize backwards-compatibility issues.
168
+ However, after checking various wheels on PyPI,
168
169
it became clear that standardizing **all ** naming on :pep: `508 ` and
169
- :pep: `503 ` semantics was easier and better long-term.
170
-
171
-
172
- Open Issues
173
- ===========
174
-
175
- N/A
170
+ :pep: `503 ` semantics was easier and better long-term,
171
+ while causing minimal backwards compatibility issues.
176
172
177
173
178
174
Copyright
0 commit comments