Warning Using legacy 'setup.py install' for pipfile, since package 'wheel' is not installed. while building python helper

[jeffwidman]

Noticed this warning:

Using legacy 'setup.py install' for pipfile, since package 'wheel' is not installed.

I'm a little confused, since wheel is already installed in a previous step.

Perhaps the problem is that both are installed during the same pip run and instead need to first install wheel and then re-run pip install with the other stuff?

Need to dig further... Looks like there might be some additional info here: pypa/pip#8102

[jeffwidman]

I think this is because pipfile has no wheel available: https://pypi.org/project/pipfile/#files

I filed pypa/pipfile#143 for pipfile to publish a wheel.

Also filed pypa/pip#11362 for pip to make the error message less confusing.

Beyond that, there's nothing we can really do here.

[deivid-rodriguez]

diff --git a/python/helpers/build b/python/helpers/build
index 6b05b879f..c2c2345b5 100755
--- a/python/helpers/build
+++ b/python/helpers/build
@@ -18,6 +18,8 @@ cp -r \
   "$install_dir"
 
 cd "$install_dir"
+PYENV_VERSION=3.10.5 pyenv exec pip install wheel
+
 PYENV_VERSION=3.10.5 pyenv exec pip install -r "requirements.txt"
 
 # Workaround of https://github.com/python-poetry/poetry/issues/3010

This seems to get rid of the warning and let pip code through the code paths it likes the most I think?

Before you get

(...)
#32 4.624 Collecting pycparser
#32 4.633   Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB)
#32 4.639      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 118.7/118.7 KB 26.0 MB/s eta 0:00:00
#32 4.661 Using legacy 'setup.py install' for pipfile, since package 'wheel' is not installed.
#32 4.781 Installing collected packages: webencodings, pylev, ptyprocess, msgpack, lockfile, distlib, wheel, virtualenv-clone, urllib3, tomlkit, tomli, toml, six, shellingham, pyparsing, pyflakes, pycparser, pycodestyle, poetry-core, platformdirs, pkginfo, pip-api, pexpect, pastel, mccabe, jeepney, idna, filelock, Cython, crashtest, click, charset-normalizer, certifi, cachy, virtualenv, requests, pipfile, pep517, packaging, html5lib, flake8, clikit, cffi, requests-toolbelt, pipenv, hashin, cryptography, cleo, cachecontrol, build, SecretStorage, pip-tools, keyring, poetry
#32 5.992   Running setup.py install for pipfile: started
#32 6.112   Running setup.py install for pipfile: finished with status 'done'
#32 7.745 Successfully installed Cython-0.29.32 SecretStorage-3.3.2 build-0.8.0 cachecontrol-0.12.11 cachy-0.3.0 certifi-2022.6.15 cffi-1.15.1 charset-normalizer-2.1.0 cleo-0.8.1 click-8.1.3 clikit-0.6.2 crashtest-0.3.1 cryptography-37.0.4 distlib-0.3.5 filelock-3.7.1 flake8-5.0.3 hashin-0.17.0 html5lib-1.1 idna-3.3 jeepney-0.8.0 keyring-23.8.1 lockfile-0.12.2 mccabe-0.7.0 msgpack-1.0.4 packaging-20.9 pastel-0.2.1 pep517-0.13.0 pexpect-4.8.0 pip-api-0.0.30 pip-tools-6.8.0 pipenv-2022.4.8 pipfile-0.0.2 pkginfo-1.8.3 platformdirs-2.5.2 poetry-1.1.14 poetry-core-1.0.8 ptyprocess-0.7.0 pycodestyle-2.9.1 pycparser-2.21 pyflakes-2.5.0 pylev-1.4.0 pyparsing-3.0.9 requests-2.28.1 requests-toolbelt-0.9.1 shellingham-1.5.0 six-1.16.0 toml-0.10.2 tomli-2.0.1 tomlkit-0.11.2 urllib3-1.26.11 virtualenv-20.16.3 virtualenv-clone-0.5.7 webencodings-0.5.1 wheel-0.37.1
(...)

With the patch you get

(...)
#32 4.520 Collecting pycparser
#32 4.529   Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB)
#32 4.533      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 118.7/118.7 KB 37.0 MB/s eta 0:00:00
#32 4.555 Building wheels for collected packages: pipfile
#32 4.556   Building wheel for pipfile (setup.py): started
#32 4.675   Building wheel for pipfile (setup.py): finished with status 'done'
#32 4.676   Created wheel for pipfile: filename=pipfile-0.0.2-py2.py3-none-any.whl size=11958 sha256=4b5edbfad74169044135ceb7633c4ec446eb7224741a802d04b65b3920e792db
#32 4.676   Stored in directory: /home/dependabot/.cache/pip/wheels/dc/12/fd/239c6cbb5f6d58d4707486ba5be928188ab7ce33f804a14785
#32 4.677 Successfully built pipfile
#32 4.794 Installing collected packages: webencodings, pylev, ptyprocess, msgpack, lockfile, distlib, virtualenv-clone, urllib3, tomlkit, tomli, toml, six, shellingham, pyparsing, pyflakes, pycparser, pycodestyle, poetry-core, platformdirs, pkginfo, pip-api, pexpect, pastel, mccabe, jeepney, idna, filelock, Cython, crashtest, click, charset-normalizer, certifi, cachy, virtualenv, requests, pipfile, pep517, packaging, html5lib, flake8, clikit, cffi, requests-toolbelt, pipenv, hashin, cryptography, cleo, cachecontrol, build, SecretStorage, pip-tools, keyring, poetry
#32 7.691 Successfully installed Cython-0.29.32 SecretStorage-3.3.2 build-0.8.0 cachecontrol-0.12.11 cachy-0.3.0 certifi-2022.6.15 cffi-1.15.1 charset-normalizer-2.1.0 cleo-0.8.1 click-8.1.3 clikit-0.6.2 crashtest-0.3.1 cryptography-37.0.4 distlib-0.3.5 filelock-3.7.1 flake8-5.0.3 hashin-0.17.0 html5lib-1.1 idna-3.3 jeepney-0.8.0 keyring-23.8.1 lockfile-0.12.2 mccabe-0.7.0 msgpack-1.0.4 packaging-20.9 pastel-0.2.1 pep517-0.13.0 pexpect-4.8.0 pip-api-0.0.30 pip-tools-6.8.0 pipenv-2022.4.8 pipfile-0.0.2 pkginfo-1.8.3 platformdirs-2.5.2 poetry-1.1.14 poetry-core-1.0.8 ptyprocess-0.7.0 pycodestyle-2.9.1 pycparser-2.21 pyflakes-2.5.0 pylev-1.4.0 pyparsing-3.0.9 requests-2.28.1 requests-toolbelt-0.9.1 shellingham-1.5.0 six-1.16.0 toml-0.10.2 tomli-2.0.1 tomlkit-0.11.2 urllib3-1.26.11 virtualenv-20.16.3 virtualenv-clone-0.5.7 webencodings-0.5.1
(...)

[jeffwidman]

Oooh, very nifty! I misread the logs and didn't realize we were downloading but not installing wheel previously.

One thing is if we do this, how do we manage the version pin of wheel?

• no pin
• pin in the separate wheel install command... works today, but outdated in the future and Dependabot won't be able to manage that pin.
• change the second pip install -r ... command to force re-install so that it respects the wheel pin and overwrites the non-pinned version. A bit janky/heavy-handed.

In some ways, this just adds complexity as well...

For now, I'd say let's float this for a few days and see if we get clarity whether if pipfile uploads a wheel that'll solve this issue (at least for the pipfile case).

[jeffwidman]

Re-opening, as we'll likely need to take some sort of action based on pypa/pip#11362 (comment).

The easy fix is manually installing wheel first. Stepping back, a better fix may be replacing the pipfile dependency since pipfile hasn't been updated in 5 years and the python community has moved forward with a slightly different packaging format:

• https://peps.python.org/pep-0508/
• https://peps.python.org/pep-0621/
• https://peps.python.org/pep-0631/

I plan to dig into a bunch of this as part of #3290 so may re-evaluate it then if nobody gets to it sooner...

[SpecLad]

The easy fix is manually installing wheel first.

Just FYI, a better way might be to add --use-pep517 to your pip install command. This will let pip automatically download wheel as part of the build process.

You probably don't even need to list wheel in your requirements.txt (unless you use this package yourself).

[jeffwidman]

Oh nifty! Thanks for pointing that out @SpecLad, I didn't realize that was an option.

Since you suggested this, do you want to submit a PR and getting credit for it on the changelog?

This is the line that's throwing the warning:

dependabot-core/python/helpers/build

Line 21 in c00c019

PYENV_VERSION=3.10.5 pyenv exec pip --disable-pip-version-check install -r "requirements.txt"

There's a few other places we use pip install that may also benefit from this flag if you grep around, but at least doing ☝️ would be good.

I can also do it if you're not interested.

[SpecLad]

Okay, PR submitted.

I ended up not removing wheel from requirements.txt, since on further inspection it seems like it is indirectly used somewhere in the Dependabot logic (I didn't dig deep enough to understand the particulars).