Pip 19.0 removes `--process-dependency-links`

  • As of pip 19.0 --process-dependency-links is removed. We should update our installation instructions.
  • PEP0508 describes new specification for package dependencies. URL dependencies can now be placed into install_requires in setup.py. See this.

There are multiple ways to write the dependency URL:

setup(
   ...
   install_requires = [
   ...
      <dependency URL>
   ...
   ]
)

Dependency URL possibilities:
    'ta3ta2-api @ git+https://gitlab.com/datadrivendiscovery/ta3ta2-api.git@dist-python'
    'ta3ta2-api @ git+https://gitlab.com/datadrivendiscovery/ta3ta2-api.git@dist-python#egg=ta3ta2-api'
    'ta3ta2-api @ git+https://gitlab.com/datadrivendiscovery/ta3ta2-api.git@dist-python#egg=ta3ta2-api#sha1=aac29424d864576694af5988e7391819d3c4c166'
    'ta3ta2-api @ https://gitlab.com/datadrivendiscovery/ta3ta2-api/-/archive/dist-python/ta3ta2-api-dist-python.zip'
    'ta3ta2-api @ https://gitlab.com/datadrivendiscovery/ta3ta2-api/-/archive/dist-python/ta3ta2-api-dist-python.zip#egg=ta3ta2-api-dist-python'
    'ta3ta2-api @ https://gitlab.com/datadrivendiscovery/ta3ta2-api/-/archive/dist-python/ta3ta2-api-dist-python.zip#egg=ta3ta2-api-dist-python#sha1=3c484b62243b73ae00ad7780776cf737668ab0ae'

It would seem third version: 'ta3ta2-api @ git+https://gitlab.com/datadrivendiscovery/ta3ta2-api.git@dist-python#egg=ta3ta2-api#sha1=aac29424d864576694af5988e7391819d3c4c166', would be a good fit for us as it specifies the branch and commit hash. This gives us the option to freeze our dependency.

Abstractly an URL would be written as: '<package_name> @ <location>@<tag>#egg=<package_name>#sha1=<commit hash>'

Downside of this is that pre-pip 18.1 does not support direct URL requirements. See release notes:

  • Allow PEP 508 URL requirements to be used as dependencies.

As a security measure, pip will raise an exception when installing packages from PyPI if those packages depend on packages not also hosted on PyPI. In the future, PyPI will block uploading packages with such external URL dependencies directly. (#4187))

Edited by Mitar