[Zope3-dev] Re: faulty releases and pypi access [update]

[Philipp von Weitershausen]

On 27 Sep 2007, at 13:47 , Stephan Richter wrote:
> On Thursday 27 September 2007 07:18, Philipp von Weitershausen wrote:
>> These are four separate cases where I've actually witnessed myself or
>> other people mess up. We're forgetful, we can't do anything about
>> that. We can, however, force us to catch our mistakes. I believe that
>> if we made everybody create the tarballs from the tag, it would
>> improve the situation a lot.
>
> Of course, an additional or other approach would be to implement a  
> tool that
> checks various things. I agree that the problems you listed are  
> solvable with
> doing the release from the tag, but there are cases that are not  
> caught:
>
> 1. In your last case, if bajium would have used "svn switch -- 
> relocate" the
> file would still be around and the release would work. I imagine  
> that most
> people would use "svn switch" because making another checkout is  
> just a
> package management mess.

Why is making another checkout a package management mess? Go to /tmp  
or ~/temp or whatever, get the checkout, do your release stuff and  
delete it again. Is this so hard? Sorry, but I fail to see how this  
is messy.

Also, regardless of what you imagine people do, if the process says  
"get a new, fresh checkout" then this is what people should do. If  
they use svn switch instead, then they're not following the process.  
End of story.

> 2. My Trove classifier problem is not solved either using this  
> approach.
> Contrary to what Tres hinted on in his E-mail , if there are errors  
> while
> registering with PyPI, no new release is added. Also, "buildout  
> setup .
> egg_info" does not verify the Trove classifiers. (Note that I think  
> the Trove
> classifiers are only one example of something going wrong.)

buildout setup? I've never seen that. I can't find any documentation  
on it in zc.buildout. How does it work? Does it call setup.py for  
every development egg in buildout.cfg? Why not just call python  
setup.py?

Anyway, I think the Trove classifiers are an edge case. I've never  
seen anyone get those wrong before, to be honest. I *have* seen  
people get other things wrong and I think these problems would all be  
solved if we made it impossible to create distributions from a branch  
or the trunk, but made people create them from tags instead.

> 3. A serious problem occurs, if you accidentally specify the wrong  
> package
> name and version in setup.py. Both happened to me yesterday, but I  
> caught it
> in time.

I assume you mean the egg name, not the package name.

I'm not sure how a tool could help you here. I suppose it could use  
some conventions (e.g. look at the packages inside the egg) or look  
at the subversion URL.

> A fairly simple tool can find and report all the problems found and  
> offer
> assistance. I think it is worth investing in one, especially since  
> it will
> reduce my overhead since my manual checking now becomes automated.

I'm not arguing against such a tool. If you are willing to come up  
with it, go for it. We should still have a proper *human* process  
first. A tool can then help us do the tedious bits.