Path: news.eternal-september.org!eternal-september.org!feeder3.eternal-september.org!fu-berlin.de!uni-berlin.de!not-for-mail
From: Thomas Passin <list1@tompassin.net>
Newsgroups: comp.lang.python
Subject: Re: Pip installs to unexpected place
Date: Sat, 19 Apr 2025 15:56:16 -0400
Lines: 78
Message-ID: <mailman.25.1745092587.3008.python-list@python.org>
References: <4ZcdYR5WnWznV1q@mail.python.org>
 <cc1c6cf5-f8b9-4528-b6b0-110499b88162@wichmann.us>
 <4Zd3YM00SYznVKQ@mail.python.org>
 <CAJQBtgmfgC5aQy_7RXwHDbsxaf1UWYY0=FNsgPPR2UzzuKfTTA@mail.gmail.com>
 <4ZdrJv0v0LznV1q@mail.python.org>
 <6d1ac10c-80c0-484b-a7e7-e1966cea1b5d@wichmann.us>
 <mailman.19.1744926071.3008.python-list@python.org>
 <m6dnueFg8f0U1@mid.individual.net> <20250418153848.w2hmxpegl3uwii3w@hjp.at>
 <e1cce2f7-e59b-42bb-95ee-602f241f545b@tompassin.net>
 <20250419085614.vbgzh7h7hggyhzsd@hjp.at>
 <0a88a780-0921-469b-a649-48f57cf972b4@tompassin.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: news.uni-berlin.de Nd8CpQI2kzES2Bj1T/Ub/QxpZlaFaH3SAtu3N1JiqNTQ==
Cancel-Lock: sha1:0F5AnYhS1DuBdN3mD+6SaM/+VyU= sha256:tndmh8tjFvZXaa2gjXMIZv9dMb/J/gwd9bkuKXGoeHs=
Return-Path: <list1@tompassin.net>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
Authentication-Results: mail.python.org; dkim=pass
 reason="2048-bit key; unprotected key"
 header.d=tompassin.net header.i=@tompassin.net header.b=PDlb22eB;
 dkim-adsp=pass; dkim-atps=neutral
X-Spam-Status: OK 0.001
X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'looks': 0.02; 'gui': 0.05;
 'scripts.': 0.07; 'suggestion': 0.07; 'python.': 0.08;
 'controlled': 0.09; 'depend': 0.09; 'enough.': 0.09; 'example.':
 0.09; 'later,': 0.09; 'locally': 0.09; 'mechanism': 0.09;
 "shouldn't": 0.09; '>>>>': 0.16; '>>>>>': 0.16; 'applies': 0.16;
 'directories': 0.16; 'directory.': 0.16; 'greg': 0.16; 'happen.':
 0.16; 'holzer': 0.16; 'mats': 0.16; 'provide.': 0.16;
 'received:10.0.0': 0.16; 'received:64.90': 0.16;
 'received:64.90.62': 0.16; 'received:64.90.62.162': 0.16;
 'received:dreamhost.com': 0.16; 'root.': 0.16; 'script,': 0.16;
 'sudo': 0.16; 'wichmann': 0.16; 'wrapper': 0.16; 'wrote:': 0.16;
 'problem': 0.16; 'python': 0.16; 'applications': 0.17; "can't":
 0.17; 'uses': 0.19; 'bug': 0.19; 'to:addr:python-list': 0.20;
 'basically': 0.22; 'maybe': 0.22; 'version': 0.23; 'install':
 0.23; 'installed': 0.23; 'seems': 0.26; 'space': 0.26; "wasn't":
 0.26; "isn't": 0.27; 'local': 0.27; '>>>': 0.28; 'sense': 0.28;
 'settings': 0.28; 'thinking': 0.28; 'wrong': 0.28; 'environment':
 0.29; 'think': 0.29; 'header:User-Agent:1': 0.30; 'packages':
 0.31; 'am,': 0.31; 'program': 0.32; "doesn't": 0.32; '(this':
 0.32; 'assume': 0.32; 'disabled': 0.32; 'python-list': 0.32;
 'received:10.0': 0.32; 'received:mailchannels.net': 0.32;
 'received:relay.mailchannels.net': 0.32; 'but': 0.32; "i'm": 0.33;
 'there': 0.33; 'path': 0.33; 'script': 0.33; 'header:In-Reply-
 To:1': 0.34; 'package': 0.34; 'one.': 0.35; 'yes,': 0.35; 'this.':
 0.35; 'really': 0.36; 'processes': 0.36; 'work,': 0.36; 'change':
 0.36; 'those': 0.36; 'using': 0.37; "it's": 0.37; 'way': 0.38;
 'use': 0.39; "that's": 0.39; 'received:100': 0.39; 'place.': 0.40;
 'something': 0.40; 'try': 0.40; 'should': 0.40; 'here.': 0.61;
 "there's": 0.61; 'great': 0.62; 'load': 0.62; 'come': 0.62;
 'simply': 0.63; 'between': 0.63; 'look': 0.65; 'forget': 0.67;
 'header:Received:6': 0.67; 'received:64': 0.68; 'site': 0.68;
 'manager': 0.68; 'launches': 0.69; 'desktop': 0.70; 'virtual':
 0.71; 'global': 0.73; 'easy': 0.74; 'supposed': 0.76; 'editing':
 0.84; 'completely.': 0.84; 'eventually': 0.84; 'location.': 0.84;
 'stretch.': 0.84; 'forces': 0.91; 'suffer': 0.91; 'tend': 0.91
X-Sender-Id: dreamhost|x-authsender|tpassin@tompassin.net
ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1745092578; a=rsa-sha256;
 cv=none;
 b=9MPcTV99Tk/ZIQYC/uwjBmX6KVMcxLNB78FkhvbleVCWDLIpeVC4PN236gnn0xQvlWCAsi
 KL8OcItSCHbsJqUsSkCjUhvHaJbBGWFDXOAxXea4RqO6k2ZQY2F29EOngiZaqhQNs9BatW
 BM+9yJV9s1a1/G641h6AGihooPQ46CjkNbSjxGwOqDFoPwPNUh0GfoCelvI3sWd/zQhlKn
 1iGKRFU20TCz/bkemXd8twuK63iHxjb+4bZMTi01dYW1QRhXvS8/JKNXkbmpkauip47Oyh
 rLu4iIJxUMTet+vscOCnx65a/ISNZOleKPbbrQNdueSG376ttGXBm1KV9X4yDg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;
 d=mailchannels.net; s=arc-2022; t=1745092578;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:mime-version:mime-version:content-type:content-type:
 content-transfer-encoding:content-transfer-encoding:
 in-reply-to:in-reply-to:references:references:dkim-signature;
 bh=MnEI4njmHWYMoUaEudhtmSKQ5oC2uS2cE/8o+FX7BZQ=;
 b=5kf80WLnZVgM57LLYQhX4ACT/PQbSOP3yES+aiXv7EfmY3pmM8s+OTg9jG2kGWYfVsa3DB
 5G7aa77roJtcTjPadk65vhPCA+7sd8OIAZ8deNNFCCs3RUQe7mpu04CxFmC+bE3UfS9Y86
 jrlYtW09VO8Is22gNmEOXB+ziNwHwjJjKObf5hOA8zErXL4JKDowSFQijQ47Y7kTkJVeBt
 K6O063GAK05ybAhrEHGP+EC7xrYiHekDS55JbWNP+2r5vpxAbCMvms7HDCRgg6nFbB5d8E
 smwA82aLPfTKCTAlQ2+CdexGPVuLow4CHlhfdm6f1M/IG3YJe5irKp3UxvyenQ==
ARC-Authentication-Results: i=1; rspamd-7bd9ff6c58-cctqr;
 auth=pass smtp.auth=dreamhost smtp.mailfrom=list1@tompassin.net
X-Sender-Id: dreamhost|x-authsender|tpassin@tompassin.net
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|tpassin@tompassin.net
X-MailChannels-Auth-Id: dreamhost
X-Harmony-Daffy: 68925e6a66c304ec_1745092578214_2390208106
X-MC-Loop-Signature: 1745092578214:3510855555
X-MC-Ingress-Time: 1745092578214
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tompassin.net;
 s=dreamhost; t=1745092577;
 bh=MnEI4njmHWYMoUaEudhtmSKQ5oC2uS2cE/8o+FX7BZQ=;
 h=Date:Subject:To:From:Content-Type:Content-Transfer-Encoding;
 b=PDlb22eBlSKzlsk45llIw2siI9QUNJU1bfJEurO8zsGAJY0leTbtUY36iVd6hafAI
 Uw9SlFCO32WwB4SuHhqHMEj2HamGJlzPTQRmQE2Hdzv5pcP/XDn3tbycgVi6mKNDiP
 HfdBWM72xUOKHTMfWfxjCIzKN8BrVmojct28/ouQY05F2qQ/wgOV+ZZq8uPAEzyPdn
 aRSK6WuWfADWSfppVZg81G+idB/PUxLUZWI+ixIp7ZJnsNOzybRGRAanUsYf+7EL7p
 hmaTDpeKLgRf2FpVA76nZGaiIAPiMk+QAsPDP/UFDThoWYHZ0VA3GKKEwPWSZd7lxv
 tz7ZxDwGoHN7A==
User-Agent: Mozilla Thunderbird
Content-Language: en-US
In-Reply-To: <20250419085614.vbgzh7h7hggyhzsd@hjp.at>
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: General discussion list for the Python programming language
 <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>,
 <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <https://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>,
 <mailto:python-list-request@python.org?subject=subscribe>
X-Mailman-Original-Message-ID: <0a88a780-0921-469b-a649-48f57cf972b4@tompassin.net>
X-Mailman-Original-References: <4ZcdYR5WnWznV1q@mail.python.org>
 <cc1c6cf5-f8b9-4528-b6b0-110499b88162@wichmann.us>
 <4Zd3YM00SYznVKQ@mail.python.org>
 <CAJQBtgmfgC5aQy_7RXwHDbsxaf1UWYY0=FNsgPPR2UzzuKfTTA@mail.gmail.com>
 <4ZdrJv0v0LznV1q@mail.python.org>
 <6d1ac10c-80c0-484b-a7e7-e1966cea1b5d@wichmann.us>
 <mailman.19.1744926071.3008.python-list@python.org>
 <m6dnueFg8f0U1@mid.individual.net> <20250418153848.w2hmxpegl3uwii3w@hjp.at>
 <e1cce2f7-e59b-42bb-95ee-602f241f545b@tompassin.net>
 <20250419085614.vbgzh7h7hggyhzsd@hjp.at>

On 4/19/2025 4:56 AM, Peter J. Holzer via Python-list wrote:
> On 2025-04-18 13:08:36 -0400, Thomas Passin via Python-list wrote:
>> On 4/18/2025 11:38 AM, Peter J. Holzer via Python-list wrote:
>>> On 2025-04-18 13:24:28 +1200, Greg Ewing via Python-list wrote:
>>>> On 18/04/25 9:41 am, Mats Wichmann wrote:
>>>>> There's just not a really great answer to this.
>>>>
>>>> Seems to me a system-installed application shouldn't be looking in the
>>>> user's .local packages in the first place. That should only be for things
>>>> the user has installed "for this user".
>>>
>>> It's not the application that looks into .local, it's Python. If you say
>>> that a system-installed Python shouldn't look into ~/.local, then you've
>>> just disabled that mechanism completely. If not then Python would
>>> somehow have to distinguish between system-installed and user-installed
>>> scripts. This isn't as easy as checking whether the path starts with
>>> /usr/bin or whether it belongs to root. Tying into the system's package
>>> manager doesn't look appealing to me (not to mention that it might be
>>> unacceptably slow).
>>
>> Let's try a specific example. Let's say that PyQt6 v6.8.3 is installed in
>> the system site directory. The OS uses PyQt6 for some system purposes. Now
>> the user comes along and forces an install of PyQt6 v6.9.0 in the user site
>> directory. 6.9.0 has a bug that would crash one of the system's application
>> but not the user's programs. (This is not a far-fetched scenario).
> 
> Agreed. Also since PyQt6 is a GUI framework, I'm going to assume that
> those applications are supposed to be invoked by the user on their
> desktop, not by a cronjob controlled by the system.
> 
> 
>> When the system launches its application the PYTHONPATH will start with
>> system site directories; local user site directories will be on the
>> PYTHONPATH but since they come later, the python will use PyQt6 v6.8.3
>> because that will come first on the path.  No crash here.
>>
>> If the user has a program that actually does require the use of v6.9.0, he's
>> going to have to make sure that the user's local site directories come first
>> on the path. One way to do that is to set the PYTHONPATH to point to the
>> user's location.
> 
> This is IMHO not practical. The user would have to set PYTHONPATH for
> some programs, but not for others. You can't do this with .bashrc (or
> similar), the user would have to write a wrapper script for each of
> their programs which depend on something in ~/.local. Possible of course
> but cumbersome.
> 
> I like Oscar's suggestion that Python scripts provided by the
> distribution include -s in the shebang much better.
> 
> Or - what I tend to do - simply use a virtual environment for each
> script that needs a package that the system doesn't provide. But of
> course that's basically "disable/don't use .local" and all those venvs
> take space and need to be maintained.

My problem with venvs, especially if I have more than one, is that I 
eventually forget what they were for and what is different about each 
one. If there's only one and it's used for all non-system work, that's 
OK but beyond that and they tend to suffer knowledge rot.

> 
>> In what scenario is a system application going to load a wrong version of a
>> dependency from a user's site location?
> 
> When the user sets PYTHONPATH and then accidentally invokes the
> system-supplied application without resetting it first.
> 
>> The only one I can think of is for the user, with the help of sudo, or
========== REMAINDER OF ARTICLE TRUNCATED ==========