{"action":"created","issue":{"url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim/issues/1","repository_url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim","labels_url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim/issues/1/comments","events_url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim/issues/1/events","html_url":"https://github.com/ncoghlan/pkg_resources_shim/issues/1","id":160957238,"number":1,"title":"Upload shim to PyPI?","user":{"login":"ncoghlan","id":1026649,"avatar_url":"https://avatars.githubusercontent.com/u/1026649?v=3","gravatar_id":"","url":"https://api.github.com/users/ncoghlan","html_url":"https://github.com/ncoghlan","followers_url":"https://api.github.com/users/ncoghlan/followers","following_url":"https://api.github.com/users/ncoghlan/following{/other_user}","gists_url":"https://api.github.com/users/ncoghlan/gists{/gist_id}","starred_url":"https://api.github.com/users/ncoghlan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncoghlan/subscriptions","organizations_url":"https://api.github.com/users/ncoghlan/orgs","repos_url":"https://api.github.com/users/ncoghlan/repos","events_url":"https://api.github.com/users/ncoghlan/events{/privacy}","received_events_url":"https://api.github.com/users/ncoghlan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-17T19:19:03Z","updated_at":"2016-06-17T19:35:20Z","closed_at":null,"body":"@jaraco Currently @dstufft has pkg_resources registered on PyPI (with no releases) to ensure that nobody can upload a malicious project that would run when someone did \"pip install pkg_resources\" instead of \"pip install setuptools\".\r\n\r\nWhat do you think of the idea of instead providing a simple shim like the one in this repo that depends on setuptools, so \"pip install pkg_resources\" will automatically install setuptools for you?\r\n\r\nAt the moment, the setup.py scripts emits a message on sys.stderr that encourages people to install setuptools directly instead, but it now occurs to me that if we removed that and made \"pip install pkg_resources\" a fully supported way of installing setuptools, people could start being more explicit about whether or not they need the full setuptools build system, or just the runtime components in pkg_resources."},"comment":{"url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim/issues/comments/226862173","html_url":"https://github.com/ncoghlan/pkg_resources_shim/issues/1#issuecomment-226862173","issue_url":"https://api.github.com/repos/ncoghlan/pkg_resources_shim/issues/1","id":226862173,"user":{"login":"ncoghlan","id":1026649,"avatar_url":"https://avatars.githubusercontent.com/u/1026649?v=3","gravatar_id":"","url":"https://api.github.com/users/ncoghlan","html_url":"https://github.com/ncoghlan","followers_url":"https://api.github.com/users/ncoghlan/followers","following_url":"https://api.github.com/users/ncoghlan/following{/other_user}","gists_url":"https://api.github.com/users/ncoghlan/gists{/gist_id}","starred_url":"https://api.github.com/users/ncoghlan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncoghlan/subscriptions","organizations_url":"https://api.github.com/users/ncoghlan/orgs","repos_url":"https://api.github.com/users/ncoghlan/repos","events_url":"https://api.github.com/users/ncoghlan/events{/privacy}","received_events_url":"https://api.github.com/users/ncoghlan/received_events","type":"User","site_admin":false},"created_at":"2016-06-17T19:35:20Z","updated_at":"2016-06-17T19:35:20Z","body":"Pragmatically, I think there might still be some bootstrapping problems with that for folks using easy_install as the basis for their Python level package management, and there'd also be additional overhead in maintaining separate CI pipelines and release processes.\r\n\r\nHowever, introducing the shim would help set that up as a future possibility - the dependency between setuptools and pkg_resources could be inverted some day, so folks already depending just on pkg_resources would stop needing to install the rest of setuptools, while folks that actually do want the whole build system would continue to get that."}}
{"actor":{"display_login":"ncoghlan"}}