Removing support for git+git@ VCS requirement scheme

[sbidoul]

What's the problem this feature will solve?

In addition to VCS requirements which have the form of a proper URL, pip also partially supports a git specific scheme of the form git+git@example.com:user/repo.git. As currently documented, this scheme is supported for editable installs only.

Supporting this scheme has a number of drawbacks:

• This creates confusion when people try to use it without the --editable option (pip requires the "-e" option to install from a scheme that starts with "git+git@" #2994, Wrong return value of a Link.is_artifact for git+user@hostname editable packages #6293).
• This also creates bugs, such as when adding the commit to the requirement, pip freeze generates requirements that pip cannot process (pip freeze generating format that's incorrectly parsed by pip install -r #2038).
• This specific format is not a proper URL, making such requirement impossible to translate to PEP 440 direct URL references.
• it would seem that support for this format is rather accidental in the pip code base (pip freeze generating format that's incorrectly parsed by pip install -r #2038 (comment), also illustrated by the fact that link.is_vcs returns False for such pseudo-URLs), and properly supporting it everywhere would be very complex.

This scheme is easily replaced by URLs such as

• git+https://git@example.com/...
• git+ssh://git@example.com/...
• git+git://git@example.com/... (insecure)

Describe the solution you'd like

Deprecate support for this format during one year, then remove it (#7543).

Alternative solutions

• fix issues as they are discovered (e.g. support this format for non-editable uses, make pip freeze transform the reference to a supported format)
• do nothing, document the exceptions

[pradyunsg]

This was released in 20.0, so 21.0 should remove this feature.

[lericson]

It is not possible to make a relative path with the URL syntax. This artificially limit the power of pip for no reason. git+… simply passes … to git clone …. For example, if I have a branch that I want to install as a dependency:

pip install -e git+./@mydep#egg=mydep

This WILL break existing software and there will be no fix.

[lericson]

Never mind, I found a workaround using the environment variable support in requirements.txt:

-e git+file://${PWD}@mydep#egg=mydep

[sbidoul]

@lericson interesting trick you found there.

Out of curiosity is this a real example using the current directory, and why can't you use -e .?

[lericson]

The idea is to bundle slightly modified dependencies as branches in Git, then let pip install them. I'm still trying to find out how well it works though.