Allow direct urls in install_requires

What’s the problem this feature will solve? I want to put a package on PyPi which uses the new direct url syntax pkg@git-repo-url from PEP 508. Uploading to PyPi yields

HTTPError: 400 Client Error: Invalid value for requires_dist. Error: Can't have direct dependency:

It is stated here that this is for “security reasons”, but as pointed out later in the thread, this seems nonsensical as setup.py could execute arbitrary code anyway. Are there any other security concerns I am missing?

Describe the solution you’d like Simply allow direct urls.

I have a package which depends on another package which I don’t want to go through the trouble of uploading to PyPi as well. This dependency then breaks installing my package from PyPi.

[frankcorneliusmartin]

Yes, I agree that it adds some level of trust, especially long lived/known (or previously used) packages. However if you do not check the contents of setup.py this level of security does no longer hold, as we do not trust everything on PyPI. Therefore making it just as secure as allowing external direct urls, this is true when not considering that it requires some effort to publish (a malicious) dependency on PyPI.

[uranusjr]

The problem is that setup.py is not only used to be directly run on your machine to install the package, but also to create a wheel, either by the developer (to upload to PyPI) or pip (to later install it). As Paul mentioned, the problem is that wheel does not (and should not, I want to add) support URL specs, so if setup(install_requires=...) does, setuptools needs to somehow convert it to a non-URL dependency when duilding the wheel, which is by no means straightforward, if at all possible. And you’d need to convince setuptools maintainers instead of pip on that.