Disallow execution of setup.py when "pip download --no-deps someproject"

[wimglenn]

There appears to be no way to download an sdist without eagerly executing setup.py file. It would be nice to have a "pip download" command that can take advantage of pip's caching layer, custom index config, handling of requirement specifiers and/or environment markers, without accidentally running Python code that could mistakenly think it is going through an installation, may crash due to missing build dependencies, or may even contain malicious code.

pip download --no-deps issue7325 could just get the issue7325-0.1.tar.gz file to current working directory, there's no need to run command egg_info since pip doesn't use the egg_info for anything as far as I can tell..

An example sdist to reproduce the issue:

$ pip download --no-deps issue7325
Collecting issue7325
  Downloading https://files.pythonhosted.org/packages/c0/51/bd28cda650e3f0123ea82936f96b3fd28da90ec8b2af89a9029e25768647/issue7325-0.1.tar.gz
  Saved ./issue7325-0.1.tar.gz
    ERROR: Command errored out with exit status 1:
     command: /usr/local/opt/python/bin/python3.7 -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/private/var/folders/ff/fytd5w312lbddqk02qcb7spr0000gn/T/pip-download-zcy4vtvf/issue7325/setup.py'"'"'; __file__='"'"'/private/var/folders/ff/fytd5w312lbddqk02qcb7spr0000gn/T/pip-download-zcy4vtvf/issue7325/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /private/var/folders/ff/fytd5w312lbddqk02qcb7spr0000gn/T/pip-download-zcy4vtvf/issue7325/pip-egg-info
         cwd: /private/var/folders/ff/fytd5w312lbddqk02qcb7spr0000gn/T/pip-download-zcy4vtvf/issue7325/
    Complete output (2 lines):
    setup.py is executing
    setup.py was executed :(
    ----------------------------------------
ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.

[chrahunt]

This looks the same as #1884, do you want to take the discussion over there?

[wimglenn]

Ouch, open since 2014 ...
Some info seems outdated, is pip install --download just an older spelling of pip download?

[chrahunt]

Yes, I updated the title so hopefully it's easier to find.

[pradyunsg]

Closing in favor of #1884. Thanks for filing this @wimglenn! :)