Cannot handle complex requirement resolution

[vbabiy]

Not only does pip not check for conflicts as noted in http://bitbucket.org/ianb/pip/src/tip/pip/req.py#cl-928, it doesn't consider any requirements on a package other than the first. So if I have

• A requires B and C
• B requires D<=1.1
• C requires D<=0.9

installing A will give us D==1.1 rather than D==0.9

---

• Bitbucket: https://bitbucket.org/ianb/pip/issue/119
• Originally Reported By: Dave Abrahams
• Originally Created At: 2010-05-09 18:35:39

[vbabiy]

Resolving version dependencies among inter-dependent packages is a complex
(but well-understood) problem. Pip will need to deal with these issues. I
suggest stealing the solver algorithm used by aptitude.

---

Original Comment By: Dave Abrahams

[vbabiy]

Tarek told me that this issue is covered in a ticket at
http://bugs.python.org, but I can't find it. I'd like to at least see a
cross-reference here before this ticket is closed.

---

Original Comment By: Dave Abrahams

[vbabiy]

Here's a cross-reference: http://bugs.python.org/issue8927. Until
responsibility for this functionality is resolved we should keep this ticket
open.

---

Original Comment By: Dave Abrahams

[vbabiy]

1. Does pip install D==1.1 silently, or error out?

2. I am just curious if there is a real-world example you know of this
   dependency? (I know that 'launchpadlib' indirectly depends on two versions of
   'martian' - but not sure if pip installs the expected version of 'martian').

---

Original Comment By: Sridhar Ratnakumar

[vbabiy]

Sridhar, there are lots of examples of such dependency conflicts in Debian
packages ; I think I recall some Python examples but I have no pointer handy.

Dave, I think it’s the responsibility of distutils2 to handle this. I’m afraid
we can’t look at Aptitude here, since it is under the GPL and
Python/distutils2 is not. However, reading documentation or papers is
possible.

I suggest keeping to bugs.python.org now.

---

Original Comment By: Éric Araujo

[vbabiy]

Éric: I agree that it's probably a distutils2 thing. However, in light of the
response to http://groups.google.com/group/the-fellowship-of-the-
packaging/browse_frm/thread/22267799eba3d90e, I don't see anything
happening over there

packaging/browse_frm/thread/22267799eba3d90e

---

Original Comment By: Dave Abrahams

[carljm]

This bug is apparently causing trouble on a regular basis with Pyramid installations and zope.interface pre-installed globally on OSX. See pull pypa/virtualenv#178

[benoitbryon]

Don't know if it helps, but zc.buildout (or maybe recipes like zc.recipe.egg?) can handle complex dependencies: it returns an error and says something like "I can't do that", which is what I expect.
So maybe the solution is in buildout's or zc.recipe.egg code.

Example I use, given sphinx requires docutils>=0.7:

pip: fail

pip install -r requirements.txt

where requirements.txt is :

sphinx==1.1.2
docutils==0.6

says

Successfully installed docutils Jinja2 Pygments sphinx

So we believe everything is ok, but...

>>>> sphinx-quickstart 
Traceback (most recent call last):
...
pkg_resources.DistributionNotFound: docutils>=0.7

Error! The install passes. The error is detected at runtime, which could be a long time later. The error message tells us that there is a dependency error, but we will have to investigate before we discover the "docutils==0.6" directive.

zc.buildout (or zc.recipe.egg): pass

Given the following buildout.cfg file:

[buildout]
parts = python
eggs =
    sphinx==1.1.2
    docutils==0.6

[python]
recipe = zc.recipe.egg
eggs = ${buildout:eggs}

Let's run buildout:

>>>> bin/buildout 
Installing python.
While:
  Installing python.
Error: There is a version conflict.
We already have: docutils 0.6
but Sphinx 1.1.2 requires 'docutils>=0.7'.

Ok. The dependency conflict is detected early. The install fails. We are aware of the conflict.

[kennknowles]

+1 I have just run into something that is probably the same issue and was going to file a ticket.

Here is repo with a minimal and clear reproduction: https://github.com/kennknowles/pip-version-issue

[benoitbryon]

I guess this ticket should be tagged with "dependency resolution" label.

[qwcode]

thanks, added the label.

[qwcode]

closing as dupe to #988