Support the most esoteric setup.py files

[ShadowJonathan]

While working on trying to figure out why dependabot doesn't work for synapse's setup.py file, I came across the python setup.py helper, which in my opinion takes a huge amount of liberties to assume how setup.py files look like.

This helper tries to outsmart python itself by manually regex-replacing(!) contents of the file, before blindly exec-ing it with locals() and globals().

This can be simplified instead by using multiprocessing (to isolate side-effects), then run a script that replaces setuptools's setup by making it send the passed requires and extras to the parent process, and then springboarding into the setup.py script (after setting the right working directory).

The only reason why i could see trying to outsmart python in regards to executing what in files would be to avoid malicious behaviour, that can be wrapped and isolated with containers, but that's not the case here, it's avoidance to dirty the output and such, that can be wrapped in a subprocess.

[jurre]

Are you referring to this helper?

[ShadowJonathan]

Yeah.

Also, i apologise for the tone in the initial message, I was still a bit weirded out at that point, and so i could've put my concerns down in a different manner.

[jeffwidman]

If it's something you'd like to see fixed and willing to submit a PR, I'm happy to give you pointers on how to debug further to pinpoint what code needs to change within dependabot-core.

However, I doubt the core team will spend much time on this as the python ecosystem seems to be moving away from setup.py in favor of pyproject.toml.