import pwd fails under Jython on Windows

[yecril71pl]

The module pwd is designed to fail under Microsoft Windows and should be avoided. The detection code fails under Jython where the platform is Java. I copied the detection code from pwd; maybe we should just try pwd and handle the exception accordingly instead.

[dstufft]

@jimbaker already has a PR for html5lib to fix them to work on Jython, that's waiting on them to get merge + release that (See: html5lib/html5lib-python#150).

[tseaver]

The current status is that pip is unusable in Jython. Given pip's choice to vendor in the requests / html5lib code, fixing it here while waiting for html5lib to get a release out with the fix is a perfectly viable choice, especially since the fix is a small, clearly-defined patch in one module. (Note that is has already been three months since this issue closed, and still no fix).

[dstufft]

We don't patch the items in pip._vendor because if we change them and we depend on those changes then downstream re-distributors cannot remove those from pip._vendor and use the proper upstream versions. There is possibly an argument to be made that most downstream re-distributors aren't redistributing Jython and especially aren't redistributing a jython specific version of pip in which case users are most likely to be using the version from PyPI which will use the bundled copy.

The question I guess is whether we want to do that or not. Personally I'd prefer not to if we can help it, so we'll likely wait till we're ready to make a release to do that and will likely poke html5lib to see about getting it sorted there.

[sigmavirus24]

Carrying patches in vendored copies of software is often a very ill-advised idea. If those patches are not included upstream, future releases may drop them accidentally and introduce regressions. Further, the best people to be fixing problems in vendored libraries are the library authors and maintainers, not people relying on the library itself. We're all fairly intelligent but sometimes things in a library can horribly wrong if we just carry our own version of it that we merge with upstream. Our patch could very well cause a vulnerability if we mindlessly re-apply it and we break something sensitive. I'm glad to hear the project does not patch any libraries in pip._vendor.

[Ivoz]

@tseaver I'd go poke the html5lib project and ask them how they're doing fixing this.

[Ivoz]

Seemed to get fixed in html5lib/html5lib-python#185