1

I have a library I maintain that has a dependency (install_requires) that is only available through a "private" pypi on ProGet, and I'm not able to figure out how to get this during build. I quote private, because no authentication is actually required.

I am familiar with the PEP 508 syntax, however, this seems to only work for repos or links to specific builds. For example, both of the following work for me:

setup(
    ...
    install_requires=[
        "<libraryname> @ git+ssh://git@git.<domain>.com:port/<reponame>.git@branch",
        "<libraryname> @ http://proget.<domain>.com/pypi/private-pypi/download/<reponame>/1.5.0/<reponame>-1.5.0.tar.gz"
    ],
    ...

In this case, I don't want to peg a specific version of the dependency in question. Instead I want something like:

setup(
    ...
    install_requires=["<libraryname>"],
    extra_index_url="http://proget.<domain>.com/pypi/private-pypi/simple"
    ...

To my knowledge there's no endpoint on ProGet that would support getting the "latest" automatically.

There are several past answers to this question, but unfortunately most either mention deprecated/removed solutions (such as dependency_links) or the pip installer of the library having some extra configuration or flags (e.g. .pypirc configuration). I want the code bundled with the library to be able to handle the dependency installation without any extra setup on the user's part.

Not sure if this is necessary to answer the question, but relevant library versions:

setuptools==45.1.0
pip==19.2.3

Thanks in advance!

After posting, I found this related question with no answer.

ZaxR
  • 4,896
  • 4
  • 23
  • 42
  • 1
    We can not simply put `trusted_host` in the package metadata directly, because it is the *user who is installing your code that needs to consent to trusting a host*, not you as the package author. – wim Feb 06 '20 at 20:22
  • That's ok re: trusted_host - makes sense, but the library should still be able to get a library from a specific source, like dependency_links used to allow. Is there a modern alternative to that? – ZaxR Feb 06 '20 at 20:36
  • IIRC those PEP 508 URL dependencies _were_ supposed to be the replacement (see [#4187](https://github.com/pypa/pip/issues/4187)) – wim Feb 06 '20 at 20:51
  • Unless I'm missing something, I think they missed this case. Without pip support for dependency_links, as far as I can tell any user of a library with a private dependency will need to add flags or config to pip install the library :/ – ZaxR Feb 06 '20 at 21:06
  • 1
    Does this answer your question? [Equivalent for \`--find-links\` in \`setup.py\`](https://stackoverflow.com/questions/57689387/equivalent-for-find-links-in-setup-py) – sinoroc Feb 06 '20 at 21:20

0 Answers0