{"action":"created","issue":{"url":"https://api.github.com/repos/pypa/pip/issues/5313","repository_url":"https://api.github.com/repos/pypa/pip","labels_url":"https://api.github.com/repos/pypa/pip/issues/5313/labels{/name}","comments_url":"https://api.github.com/repos/pypa/pip/issues/5313/comments","events_url":"https://api.github.com/repos/pypa/pip/issues/5313/events","html_url":"https://github.com/pypa/pip/issues/5313","id":316209937,"number":5313,"title":"pip install explicit requirements fails (but implicit succeeds)","user":{"login":"MPV","id":62675,"avatar_url":"https://avatars3.githubusercontent.com/u/62675?v=4","gravatar_id":"","url":"https://api.github.com/users/MPV","html_url":"https://github.com/MPV","followers_url":"https://api.github.com/users/MPV/followers","following_url":"https://api.github.com/users/MPV/following{/other_user}","gists_url":"https://api.github.com/users/MPV/gists{/gist_id}","starred_url":"https://api.github.com/users/MPV/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MPV/subscriptions","organizations_url":"https://api.github.com/users/MPV/orgs","repos_url":"https://api.github.com/users/MPV/repos","events_url":"https://api.github.com/users/MPV/events{/privacy}","received_events_url":"https://api.github.com/users/MPV/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-20T10:13:54Z","updated_at":"2018-04-20T14:01:04Z","closed_at":null,"author_association":"NONE","body":"* Pip version: `10.0.0`\r\n* Python version: `2.7.12`\r\n* Operating system: Ubuntu 16.04\r\n\r\n### Description:\r\n\r\n*What I'm trying to get done:*\r\nLet Ansible install some pip packages.\r\n\r\n*What has happened:*\r\n1. I run Ansible as part of PXE boot of a new machine.\r\n2. Ansible pre-installs `cryptography` version `1.2.3` as part of its setup.\r\n3. Ansible asks `pip` to install `PyOpenSSL` and `cryptography`.\r\n4. Pip breaks itself (by allowing mismatching versions to be installed).\r\n\r\n*What went wrong:*\r\n`PyOpenSSL` requires `cryptography` version `2.2.1` (as per https://github.com/pyca/pyopenssl/issues/559#issuecomment-254190188)  but `pip` fails to upgrade it from `1.2.3` to `2.2.1` when asked\r\n\r\n*What I had expected:*\r\nOne of the following:\r\n1. `pip install` exiting with non-zero return code when it's not able to solve the dependecies.\r\n2. `pip install` succeeding in installing both `PyOpenSSL` and `cryptography==2.2.1` (in this example).\r\n\r\n### What I've run:\r\n\r\n1. Have an earlier version of (for example) `cryptography` installed (as in my case, setup of Ansible has installed):\r\n\r\n```\r\n$ pip2 install cryptography==1.2.3\r\nCollecting cryptography==1.2.3\r\nRequirement already satisfied: cffi>=1.4.1 in /usr/local/lib/python2.7/dist-packages (from cryptography==1.2.3) (1.11.5)\r\nCollecting six>=1.4.1 (from cryptography==1.2.3)\r\n  Using cached https://files.pythonhosted.org/packages/67/4b/141a581104b1f6397bfa78ac9d43d8ad29a7ca43ea90a2d863fe3056e86a/six-1.11.0-py2.py3-none-any.whl\r\nRequirement already satisfied: idna>=2.0 in /usr/local/lib/python2.7/dist-packages (from cryptography==1.2.3) (2.6)\r\nRequirement already satisfied: enum34 in /usr/lib/python2.7/dist-packages (from cryptography==1.2.3) (1.1.2)\r\nCollecting pyasn1>=0.1.8 (from cryptography==1.2.3)\r\n  Using cached https://files.pythonhosted.org/packages/ba/fe/02e3e2ee243966b143657fb8bd6bc97595841163b6d8c26820944acaec4d/pyasn1-0.4.2-py2.py3-none-any.whl\r\nRequirement already satisfied: setuptools>=1.0 in /usr/lib/python2.7/dist-packages (from cryptography==1.2.3) (20.7.0)\r\nRequirement already satisfied: ipaddress in /usr/lib/python2.7/dist-packages (from cryptography==1.2.3) (1.0.16)\r\nRequirement already satisfied: pycparser in /usr/local/lib/python2.7/dist-packages (from cffi>=1.4.1->cryptography==1.2.3) (2.18)\r\nInstalling collected packages: six, pyasn1, cryptography\r\nSuccessfully installed cryptography-1.2.3 pyasn1-0.4.2 six-1.11.0\r\n```\r\n\r\n2. Install some more packages:\r\n\r\n...in this case `PyOpenSSL` and `cryptography` — where `PyOpenSSL` requires `cryptography==2.2.1`:\r\n\r\n```\r\n$ pip2 install PyOpenSSL cryptography\r\nCollecting PyOpenSSL\r\n  Using cached https://files.pythonhosted.org/packages/79/db/7c0cfe4aa8341a5fab4638952520d8db6ab85ff84505e12c00ea311c3516/pyOpenSSL-17.5.0-py2.py3-none-any.whl\r\nRequirement already satisfied: cryptography in /usr/local/lib/python2.7/dist-packages (1.2.3)\r\nRequirement already satisfied: six>=1.5.2 in /usr/local/lib/python2.7/dist-packages (from PyOpenSSL) (1.11.0)\r\nRequirement already satisfied: cffi>=1.4.1 in /usr/local/lib/python2.7/dist-packages (from cryptography) (1.11.5)\r\nRequirement already satisfied: idna>=2.0 in /usr/local/lib/python2.7/dist-packages (from cryptography) (2.6)\r\nRequirement already satisfied: enum34 in /usr/lib/python2.7/dist-packages (from cryptography) (1.1.2)\r\nRequirement already satisfied: pyasn1>=0.1.8 in /usr/local/lib/python2.7/dist-packages (from cryptography) (0.4.2)\r\nRequirement already satisfied: setuptools>=1.0 in /usr/lib/python2.7/dist-packages (from cryptography) (20.7.0)\r\nRequirement already satisfied: ipaddress in /usr/lib/python2.7/dist-packages (from cryptography) (1.0.16)\r\nRequirement already satisfied: pycparser in /usr/local/lib/python2.7/dist-packages (from cffi>=1.4.1->cryptography) (2.18)\r\npyopenssl 17.5.0 has requirement cryptography>=2.1.4, but you'll have cryptography 1.2.3 which is incompatible.\r\nInstalling collected packages: PyOpenSSL\r\nSuccessfully installed PyOpenSSL-17.5.0\r\n```\r\n\r\nNote the line:\r\n\r\n`pyopenssl 17.5.0 has requirement cryptography>=2.1.4, but you'll have cryptography 1.2.3 which is incompatible.`\r\n\r\n...but the return code isn't zero?\r\n\r\n```\r\n$ echo $?\r\n0\r\n```\r\n\r\nHad I received a non-zero return code, my Ansible script would've stopped and I could've understood that something in my intended setup was broken. Now instead:\r\n\r\n3. Suddenly `pip2` is broken:\r\n\r\n```\r\n$ pip2\r\nTraceback (most recent call last):\r\n  File \"/usr/local/bin/pip2\", line 7, in <module>\r\n    from pip._internal import main\r\n  File \"/usr/local/lib/python2.7/dist-packages/pip/_internal/__init__.py\", line 42, in <module>\r\n    from pip._internal import cmdoptions\r\n  File \"/usr/local/lib/python2.7/dist-packages/pip/_internal/cmdoptions.py\", line 16, in <module>\r\n    from pip._internal.index import (\r\n  File \"/usr/local/lib/python2.7/dist-packages/pip/_internal/index.py\", line 15, in <module>\r\n    from pip._vendor import html5lib, requests, six\r\n  File \"/usr/local/lib/python2.7/dist-packages/pip/_vendor/requests/__init__.py\", line 86, in <module>\r\n    from pip._vendor.urllib3.contrib import pyopenssl\r\n  File \"/usr/local/lib/python2.7/dist-packages/pip/_vendor/urllib3/contrib/pyopenssl.py\", line 46, in <module>\r\n    import OpenSSL.SSL\r\n  File \"/usr/local/lib/python2.7/dist-packages/OpenSSL/__init__.py\", line 8, in <module>\r\n    from OpenSSL import crypto, SSL\r\n  File \"/usr/local/lib/python2.7/dist-packages/OpenSSL/SSL.py\", line 204, in <module>\r\n    if _lib.Cryptography_HAS_SSL_ST:\r\nAttributeError: 'module' object has no attribute 'Cryptography_HAS_SSL_ST'\r\n```\r\n\r\n#### In comparison... \r\n\r\nNow let's compare the above scenario with this: \r\n\r\n*I just install `PyOpenSSL` (which requires `cryptography`) but not `cryptography` explicitly:*\r\n\r\n1. Starting from scratch, as before, pre-install earlier version of `cryptography`:\r\n\r\n```\r\n$ pip2 install cryptography==1.2.3\r\nCollecting cryptography==1.2.3\r\nRequirement already satisfied: cffi>=1.4.1 in /usr/local/lib/python2.7/dist-packages (from cryptography==1.2.3) (1.11.5)\r\nCollecting six>=1.4.1 (from cryptography==1.2.3)\r\n  Using cached https://files.pythonhosted.org/packages/67/4b/141a581104b1f6397bfa78ac9d43d8ad29a7ca43ea90a2d863fe3056e86a/six-1.11.0-py2.py3-none-any.whl\r\nRequirement already satisfied: idna>=2.0 in /usr/local/lib/python2.7/dist-packages (from cryptography==1.2.3) (2.6)\r\nRequirement already satisfied: enum34 in /usr/lib/python2.7/dist-packages (from cryptography==1.2.3) (1.1.2)\r\nCollecting pyasn1>=0.1.8 (from cryptography==1.2.3)\r\n  Using cached https://files.pythonhosted.org/packages/ba/fe/02e3e2ee243966b143657fb8bd6bc97595841163b6d8c26820944acaec4d/pyasn1-0.4.2-py2.py3-none-any.whl\r\nRequirement already satisfied: setuptools>=1.0 in /usr/lib/python2.7/dist-packages (from cryptography==1.2.3) (20.7.0)\r\nRequirement already satisfied: ipaddress in /usr/lib/python2.7/dist-packages (from cryptography==1.2.3) (1.0.16)\r\nRequirement already satisfied: pycparser in /usr/local/lib/python2.7/dist-packages (from cffi>=1.4.1->cryptography==1.2.3) (2.18)\r\nInstalling collected packages: six, pyasn1, cryptography\r\nSuccessfully installed cryptography-1.2.3 pyasn1-0.4.2 six-1.11.0\r\n```\r\n\r\n2. Ask `pip` to install only `PyOpenSSL` this time:\r\n\r\n```\r\n$ pip2 install PyOpenSSL\r\nCollecting PyOpenSSL\r\n  Using cached https://files.pythonhosted.org/packages/79/db/7c0cfe4aa8341a5fab4638952520d8db6ab85ff84505e12c00ea311c3516/pyOpenSSL-17.5.0-py2.py3-none-any.whl\r\nCollecting cryptography>=2.1.4 (from PyOpenSSL)\r\n  Using cached https://files.pythonhosted.org/packages/dd/c2/3a5bfefb25690725824ade71e6b65449f0a9f4b29702cce10560f786ebf6/cryptography-2.2.2-cp27-cp27mu-manylinux1_x86_64.whl\r\nRequirement already satisfied: six>=1.5.2 in /usr/local/lib/python2.7/dist-packages (from PyOpenSSL) (1.11.0)\r\nRequirement already satisfied: cffi>=1.7; platform_python_implementation != \"PyPy\" in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1.4->PyOpenSSL) (1.11.5)\r\nRequirement already satisfied: enum34; python_version < \"3\" in /usr/lib/python2.7/dist-packages (from cryptography>=2.1.4->PyOpenSSL) (1.1.2)\r\nRequirement already satisfied: asn1crypto>=0.21.0 in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1.4->PyOpenSSL) (0.24.0)\r\nRequirement already satisfied: idna>=2.1 in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1.4->PyOpenSSL) (2.6)\r\nRequirement already satisfied: ipaddress; python_version < \"3\" in /usr/lib/python2.7/dist-packages (from cryptography>=2.1.4->PyOpenSSL) (1.0.16)\r\nRequirement already satisfied: pycparser in /usr/local/lib/python2.7/dist-packages (from cffi>=1.7; platform_python_implementation != \"PyPy\"->cryptography>=2.1.4->PyOpenSSL) (2.18)\r\nInstalling collected packages: cryptography, PyOpenSSL\r\n  Found existing installation: cryptography 1.2.3\r\n    Uninstalling cryptography-1.2.3:\r\n      Successfully uninstalled cryptography-1.2.3\r\nSuccessfully installed PyOpenSSL-17.5.0 cryptography-2.2.2\r\n```\r\n\r\nNote how *this time* `pip` succeeds in upgrading `cryptography` from `1.2.3` to `2.2.2`. 🎉 \r\n\r\n3. And how this time `pip` isn't broken:\r\n\r\n```\r\n$ pip2\r\n\r\nUsage:\r\n  pip2 <command> [options]\r\n[...]\r\n```\r\n\r\n------------------------------------------------------------------------------------------\r\n\r\n**Note:** \r\n- I didn't have this problem when I ran the same Ansible setup and scripts 2 weeks ago.\r\n- I've yet to test (and confirm) whether this is related to `pip` version `10.0.0`. \r\n- I do know that the machines that this has worked on before are running `pip` version `9.0.3`.\r\n\r\n------------------------------------------------------------------------------------------\r\n\r\nI might just be using `pip` in the wrong way here.\r\nOr could there be a bug in `pip` related to this? 😊"},"comment":{"url":"https://api.github.com/repos/pypa/pip/issues/comments/383105469","html_url":"https://github.com/pypa/pip/issues/5313#issuecomment-383105469","issue_url":"https://api.github.com/repos/pypa/pip/issues/5313","id":383105469,"user":{"login":"MPV","id":62675,"avatar_url":"https://avatars3.githubusercontent.com/u/62675?v=4","gravatar_id":"","url":"https://api.github.com/users/MPV","html_url":"https://github.com/MPV","followers_url":"https://api.github.com/users/MPV/followers","following_url":"https://api.github.com/users/MPV/following{/other_user}","gists_url":"https://api.github.com/users/MPV/gists{/gist_id}","starred_url":"https://api.github.com/users/MPV/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MPV/subscriptions","organizations_url":"https://api.github.com/users/MPV/orgs","repos_url":"https://api.github.com/users/MPV/repos","events_url":"https://api.github.com/users/MPV/events{/privacy}","received_events_url":"https://api.github.com/users/MPV/received_events","type":"User","site_admin":false},"created_at":"2018-04-20T14:01:04Z","updated_at":"2018-04-20T14:01:04Z","author_association":"NONE","body":"On second review, could this maybe be a duplicate of #988 ?"}}
{"actor":{"display_login":"MPV"}}