`_get_exposed_apps_for_package` and `pipx uninstall` should use metadata to determine apps

Describe the bug

As detailed in #548 by @jwodder (https://github.com/pipxproject/pipx/issues/548#issuecomment-733831958):

I believe I know what’s going on. I just stumbled upon this behavior and was about to file a bug report.

The problem is: When pipx installs package foo that depends on bar that has an entry point bar-cmd, if a bar-cmd program already exists in PIPX_BIN_DIR (e.g., if bar is already installed at the user level), then bar-cmd will be listed as a pipx-installed command in the output from pipx install and pipx list even though it is not. Fortunately, pipx has enough sense to not delete bar-cmd when pipx uninstall foo is run, which suggests that it can tell whether a given command is managed by pipx, it’s just not doing it in all cases.

This may only be happening for Windows and other filesystems that pipx thinks have no symlinks. EDIT: This seems to occur anytime there are non-symlinked files inside of ~/.local/bin, which can happen either through pipx or through other tools like pip install --user that install to that directory.

Since the code that examines the binary directory was likely implemented before we had metadata in pipx, we should use our available metadata now to make app attribution more robust.

How to reproduce

On Windows:

> pipx install textract
done!
creating virtual environment...
installing textract...
  installed package textract 1.6.3, Python 3.9.0
  These apps are now globally available
    - textract
> pipx install organize-tool
done!
creating virtual environment...
installing organize-tool...
  installed package organize-tool 1.9.1, Python 3.9.0
  These apps are now globally available
    - organize.exe
    - textract
>

Expected behavior

textract should not be listed as an organize-tool app, because it is a dependency of organize-tool and organize-tool was not installed using --include-deps.

[jwodder]

Here’s a transcript from reproducing the bug on Docker:

firefly:~$ docker run --rm -it python:3.8 /bin/bash
root@fdedcf1a3ddd:/# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
root@fdedcf1a3ddd:/# pip install --user keyring
Collecting keyring
  Downloading keyring-21.5.0-py3-none-any.whl (32 kB)
Collecting SecretStorage>=3.2; sys_platform == "linux"
  Downloading SecretStorage-3.3.0-py3-none-any.whl (14 kB)
Collecting jeepney>=0.4.2; sys_platform == "linux"
  Downloading jeepney-0.6.0-py3-none-any.whl (45 kB)
     |████████████████████████████████| 45 kB 2.3 MB/s
Collecting cryptography>=2.0
  Downloading cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (2.6 MB)
     |████████████████████████████████| 2.6 MB 11.7 MB/s
Collecting six>=1.4.1
  Downloading six-1.15.0-py2.py3-none-any.whl (10 kB)
Collecting cffi!=1.11.3,>=1.8
  Downloading cffi-1.14.4-cp38-cp38-manylinux1_x86_64.whl (411 kB)
     |████████████████████████████████| 411 kB 15.5 MB/s
Collecting pycparser
  Downloading pycparser-2.20-py2.py3-none-any.whl (112 kB)
     |████████████████████████████████| 112 kB 18.1 MB/s
Installing collected packages: six, pycparser, cffi, cryptography, jeepney, SecretStorage, keyring
  WARNING: The script keyring is installed in '/root/.local/bin' which is not on PATH.
  Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
Successfully installed SecretStorage-3.3.0 cffi-1.14.4 cryptography-3.2.1 jeepney-0.6.0 keyring-21.5.0 pycparser-2.20 six-1.15.0
root@fdedcf1a3ddd:/# export PATH=$PATH:$HOME/.local/bin
root@fdedcf1a3ddd:/# ls -l ~/.local/bin
total 4
-rwxr-xr-x 1 root root 215 Nov 25 20:29 keyring
root@fdedcf1a3ddd:/# ls -lAFC ~/.local/bin
keyring*
root@fdedcf1a3ddd:/# pip install --user pipx
Collecting pipx
  Downloading pipx-0.15.6.0-py3-none-any.whl (43 kB)
     |████████████████████████████████| 43 kB 2.2 MB/s
Collecting packaging>=20.0
  Downloading packaging-20.4-py2.py3-none-any.whl (37 kB)
Collecting argcomplete<2.0,>=1.9.4
  Downloading argcomplete-1.12.2-py2.py3-none-any.whl (38 kB)
Collecting userpath>=1.4.1
  Downloading userpath-1.4.1-py2.py3-none-any.whl (14 kB)
Collecting pyparsing>=2.0.2
  Downloading pyparsing-2.4.7-py2.py3-none-any.whl (67 kB)
     |████████████████████████████████| 67 kB 5.4 MB/s
Requirement already satisfied: six in /root/.local/lib/python3.8/site-packages (from packaging>=20.0->pipx) (1.15.0)
Collecting distro; platform_system == "Linux"
  Downloading distro-1.5.0-py2.py3-none-any.whl (18 kB)
Collecting click
  Downloading click-7.1.2-py2.py3-none-any.whl (82 kB)
     |████████████████████████████████| 82 kB 969 kB/s
Installing collected packages: pyparsing, packaging, argcomplete, distro, click, userpath, pipx
Successfully installed argcomplete-1.12.2 click-7.1.2 distro-1.5.0 packaging-20.4 pipx-0.15.6.0 pyparsing-2.4.7 userpath-1.4.1
root@fdedcf1a3ddd:/# pipx install twine
  installed package twine 3.2.0, Python 3.8.6
  These apps are now globally available
    - keyring
    - twine
done! ✨ 🌟 ✨
root@fdedcf1a3ddd:/# ls -lAFC ~/.local/bin
activate-global-python-argcomplete*            python-argcomplete-tcsh*
distro*                                        register-python-argcomplete*
keyring*                                       twine@
pipx*                                          userpath*
python-argcomplete-check-easy-install-script*
root@fdedcf1a3ddd:/#

[itsayellow]

OH, I see. Because you are installing keyring outside of pipx, those apps do not get symlinks, even though you are on a symlink-capable system. Therefore when pipx scans the ~/.local/bin directory and sees those apps without links, it falls back on the “bad” way of attributing apps.

Got it. Ok this all makes sense.