Vendoring of `tenacity` is leaky
See original GitHub issueDescription
Tenacity contains a conditional import of tornado. This makes the behavior of pip
sensitive to third-party packages outside of its vendor directory. Specifically, if a version of tornado that does not include the tornado.gen.sleep
function is installed, pip
will fail to start. (This is unlikely since this function has been around a long time and we have no plans of deprecating it or removing it. But we do have a report of this happening in https://github.com/tornadoweb/tornado/issues/3034)
Expected behavior
Pip should not be affected by the presence or absence of any other third-party packages. Any conditional imports in its vendored dependencies should be modified to unconditionally fail (e.g. replace the above-linked block with tornado = None
).
pip version
21.1.2
Python version
3.8
OS
linux
How to Reproduce
pip install tornado==4.0.0
pip --version
Output
~/ImpressionableVoluminousCategories$ pip --version
pip 21.1.2 from /opt/virtualenvs/python3/lib/python3.8/site-packages/pip (python 3.8)
~/ImpressionableVoluminousCategories$ pip install tornado==4.0.0
Collecting tornado==4.0.0
Downloading tornado-4.0.tar.gz (313 kB)
|████████████████████████████████| 313 kB 4.5 MB/s
Requirement already satisfied: certifi in /opt/virtualenvs/python3/lib/python3.8/site-packages (from tornado==4.0.0) (2020.12.5)
Building wheels for collected packages: tornado
Building wheel for tornado (setup.py) ... done
Created wheel for tornado: filename=tornado-4.0-cp38-cp38-linux_x86_64.whl size=344556 sha256=d9c5e6911e5bdac5b90db4b33d01891562365e235396bd336380dd45cb61a9b7
Stored in directory: /home/runner/.cache/pip/wheels/9a/d7/93/a846246f95067512a78899329bdb84a695d693e67c28a4e71f
Successfully built tornado
Installing collected packages: tornado
Successfully installed tornado-4.0
~/ImpressionableVoluminousCategories$ pip --version
Traceback (most recent call last):
File "/opt/virtualenvs/python3/bin/pip", line 5, in <module>
from pip._internal.cli.main import main
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/cli/main.py", line 9, in <module>
from pip._internal.cli.autocompletion import autocomplete
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/cli/autocompletion.py", line 10, in <module>
from pip._internal.cli.main_parser import create_main_parser
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/cli/main_parser.py", line 8, in <module>
from pip._internal.cli import cmdoptions
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/cli/cmdoptions.py", line 23, in <module>
from pip._internal.cli.parser import ConfigOptionParser
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/cli/parser.py", line 12, in <module>
from pip._internal.configuration import Configuration, ConfigurationError
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/configuration.py", line 27, in <module>
from pip._internal.utils.misc import ensure_dir, enum
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_internal/utils/misc.py", line 38, in <module>
from pip._vendor.tenacity import retry, stop_after_delay, wait_fixed
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_vendor/tenacity/__init__.py", line 523, in <module>
from pip._vendor.tenacity.tornadoweb import TornadoRetrying
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_vendor/tenacity/tornadoweb.py", line 26, in <module>
class TornadoRetrying(BaseRetrying):
File "/opt/virtualenvs/python3/lib/python3.8/site-packages/pip/_vendor/tenacity/tornadoweb.py", line 27, in TornadoRetrying
def __init__(self, sleep=gen.sleep, **kwargs):
AttributeError: module 'tornado.gen' has no attribute 'sleep'
~/ImpressionableVoluminousCategories$
### Code of Conduct
- [X] I agree to follow the [PSF Code of Conduct](https://www.python.org/psf/conduct/).
Issue Analytics
- State:
- Created 2 years ago
- Comments:11 (10 by maintainers)
It appears to be new in 21.1 (introduced in https://github.com/pypa/pip/commit/64ecfc8476fc74e524e2be110ae86b13a9ee9a17). It is indeed rare (it requires using a version of Tornado from before Feb 2015), but it has happened and when it happens it breaks things in a way that you can’t really recover from without blowing away the virtualenv. (but overall I’m ambivalent too - personally I’d probably wait for a second occurrence before starting a release).
FYI we’ve had a second commenter on https://github.com/tornadoweb/tornado/issues/3034 so it does look like this is affecting more than one person.