pip3 pkg provider on Python 3.11.2 fails without break-system-packages

[damonbreeden]

Describe the Bug

on Python 3.11.2 (bookworm default) pip3 pkgs can't be installed without a specific flag --break-system-packages

Expected Behavior

pkgs to be installed without adding flags everywhere

Steps to Reproduce

Steps to reproduce the behavior:
install python 3.11 on bookworm
install a pkg with pip3 provider

Environment

• Version [puppet 7.29.1]
• Platform [Python 3.11.2, debian 12 bookworm]

Additional Context

Add any other context about the problem here.
i have to add this all over my codebase:

    provider        => 'pip3',
    install_options => '--break-system-packages',

[benjamir]

Convinience over safety?

1. System-wide apps on a stable Debian installation are mainly managed by apt.
2. Puppet provides the ability to manage system-wide packages via apt (why pip at all?)
3. pip is just a random app, that should not break a system installation (that's what a lot of server admins expect) -- as an admin I don't care what anybody does with "--user", go and play there
4. Sytem-wide pip on Debian is a minefield

To me the flag is anything but a bug. I consider it a careful decision that the choice made by Debian regarding pip is mirrored in puppet.
Implicit handling of the flag would assume everbody is aware about the implications for the whole OS.

IMO should be closed as "invalid".

[damonbreeden]

When we use puppet to configure a server the assumption is that I, as the one configuring puppet, know the ramifications of installing packages, from whatever source. The other assumption is that I’m competent enough to recover when things go sideways. Maybe just a flag we can set in hiera would solve for both of us: I don’t have to whitelist every app individually, and you can have plausible deniability when somebody’s systems blow up? It occurs to me that maybe this isn’t even the right forum for this discussion- is the pip package provider from puppet or is it part of the python module?

…

On Jul 4, 2024 at 4:48 PM -0500, Benjamin ***@***.***>, wrote: Convinience over safety? 1. System-wide apps on a stable Debian installation are mainly managed by apt. 2. Puppet provides the ability to manage system-wide packages via apt (why pip at all?) 3. pip is just a random app, that should not break a system installation (that's what a lot of server admins expect) -- as an admin I don't care what anybody does with "--user", go and play there 4. Sytem-wide pip on Debian is a minefield To me the flag is anything but a bug. I consider it a careful decision that the choice made by Debian regarding pip is mirrored in puppet. Implicit handling of the flag would assume everbody is aware about the implications for the whole OS. IMO should be closed as "invalid". — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[joshcooper]

It occurs to me that maybe this isn’t even the right forum for this discussion- is the pip package provider from puppet or is it part of the python module?

The pip3 (and related) providers are in puppet https://github.com/puppetlabs/puppet/blob/main/lib/puppet/provider/package/pip3.rb There are separate modules for managing pip and virtual environments like https://github.com/voxpupuli/puppet-python/blob/master/examples/pip.pp

expected behavior: pkgs to be installed without adding flags everywhere

Are you suggesting we add --break-system-packages by default? That seems like not a good idea in general. Can you provide more details about what package you're installing and the error you get?