Extras not getting installed when the package that includes the extras has already been installed

[eeshangarg]

A similar issue was reported and fixed here for pip.

In our case:

1. We have a repo with multiple packages in it.
2. We have the zulip_bots package that depends on requests and simple_salesforce. simple_salesforce further depends on requests[security].
3. The zulip_bots package also depends on the zulip package in the same repo which also depends on/installs requests. So, it is clear that requests does get installed whether you install zulip or zulip_bots.
4. We usually use our provision script to set up a dev env and install the zulip and zulip_bots packages.
5. But recently, when we ran this executable (part of the zulip_bots package), we ran into:

pkg_resources.DistributionNotFound: The 'cryptography>=1.3.4; extra == "security"' distribution was not found and is required by requests

The above error led us to conclude that for some reason, requests[security] was not getting satisfied as expected.

It would mean a lot to us if someone could please shed some light on whether this is a manifestation of pypa/pip#3189 and pypa/pip#3198 or simply a quirk in our understanding of how extra dependencies are resolved! Thanks! :)

[jaraco]

Since you're using pip to install the packages and since the issue you're experiencing seems to match closely with the reported issue and fix, I think your instinct is right that there's nothing involving setuptools here. Perhaps you should try installing the pip from the repo and see if that addresses your concern, and if not, report an issue with pip.