[Qgis-developer] Module dependencies

[Alex Mandel]

On 09/23/2014 08:22 AM, Trevor Wiens wrote:
> I agree with earlier comments that this is largely a distribution problem
> and that automatic functionality creates some risks.
> 
> I posted yesterday about how Windows installs having their own versions of
> python installed makes using tools like pip or easy_install challenging.
> 
> I can see two possible ways forward:
> 1. Use a generic python install rather than installing its own version.
> This way pip and other tools will work fine.
> 2. Provide a tool to execute pip for the QGIS specific version of python
> for Windows installs (I don't know what happens under Max OS)
> 
> It seems to me that option 1 would be the most obvious choice making
> Windows installs similar to Linux installs and simpler to add and remove
> libraries as needed. I think that adding more and more stuff to the OSGeo4W
> install doesn't make sense.
> 

There's a reason OSGeo4w installs it's own Python. Unlike Mac and Linux,
Windows does not ship with Python. There are other common GIS
applications that do ship Python and it often conflicts with OSGeo4w
Python (Version, Compiler, and OSGeo GDAL/OGR namespace). Many python
libraries actually require compiling of C modules, which isn't handled
by pip (binary files have to be in pypi). So in part it's really hard to
rely on the Windows Python if there at all to be the right version, and
multiple versions of Python on Windows fight for the registry entry
(last installed wins). So someone installing Python 3 can easily break
QGIS if relying on system python.

I'll also note that several people have had success using pip within
OSGeo4w. See previous posts on qgis and osgeo4w lists. Making pip easier
to use in OSGeo4w is likely a better choice.

Several of us on IRC have discussed this topic in depth before, at least
in regards to external python deps. My leaning is to just wrap pip
functionality to help users.

As for python plugin deps, I say, only allow deps on core python plugins
and on plugins in the official repo. As is, if someone loads python
code, it can always download whatever from some url using pure python.
Hard to hide it when the code is open and available, but we don't
heavily check it either. On that note, we should also consider moving
the python plugin repo to https.

Thanks,
Alex