Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IDNA package source installation is broken in Poetry - Adhere to PEP-721 #151

Closed
danni-m opened this issue Nov 9, 2023 · 2 comments
Closed

Comments

@danni-m
Copy link

danni-m commented Nov 9, 2023

Poetry follows the new PEP-721 (https://peps.python.org/pep-0721/), forcing source packages to be extracted with "data_filter".

This causes Poetry to fail source distribution installation for IDNA (python-poetry/poetry#8645).

@kjd
Copy link
Owner

kjd commented Nov 23, 2023

It appears the source of this issue is that idna/tools/intranges.py is a symlink to ../idna/intranges.py, which involves backward traversal one level that doesn't escape the source tree. According to PEP-721, "Tools MAY treat them as [invalid], but are NOT REQUIRED to do so". It seems like Poetry treats this as a violation.

Perhaps the idna-data can be refactored to not require this symlink, but I don't immediately see a security issue underlying the current composition.

@kjd
Copy link
Owner

kjd commented Nov 23, 2023

Should now be fixed by using another strategy to import without using a backward traversing symlink

@kjd kjd closed this as completed Nov 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants