pip wheel . does not follow symlinks whereas python setup.py bdist_wheel does

[sbidoul]

When the package source code contains symlinks, python setup.py bdist_wheel follows them and store their content in the resulting wheel.

pip wheel . ignores them.

[sbidoul]

I was apparently using a wrong branch. Sorry for the noise.

[sbidoul]

After all I could reproduce. The directory structure must be as follow

• linked
• setup
• setup/setup.py
• setup/package -> ../linked

In the setup directory, when runnning setup.py bdist_wheel, the package is properly included, while running pip wheel . does not include it.

The root cause seems to be that bdist_wheel builds in place, while pip wheel copies the directory to another temporary place where it builds, and it does that without following the symlinks.

So my first question is why pip wheel does this copy when the source is a local directory?

[dstufft]

This is going to effectively be as intended. We copy the directory so as not to modify the source directory and to contain all of our modifications to a throw away temporary directory.

[sbidoul]

@dstufft would it make sense to follow symlinks when copying?

[dstufft]

@sbidoul Without thinking too hard about it I could see allowing that, but I'd need to make sure we weren't doing that for a reason.

[RonnyPfannschmidt]

@sbidoul that would present as massive security issue in many cases (symlink attacks are a pain)

[dstufft]

@RonnyPfannschmidt I'm not sure that's true, since we're going to be executing a setup.py anyways after we copy it, I doubt there's anything you can do with symlinks you couldn't just do in the Python file itself.

[RonnyPfannschmidt]

@dstufft a paranoid possibility is using a symlink attack to turn a package that ships web served data into a package that ships web served data and some private details of the package builder, but building wheels in isolation should elevate that

[sbidoul]

@RonnyPfannschmidt @dstufft my point is that setup.py bdist_wheel does follow symlinks whereas pip wheel . does not. In my understanding the resulting wheel must be identical. So if there is any security implication (which I doubt) it is already present in setuptools.

[sbidoul]

@dstufft @xavfernandez does my last comment warrant reopening this?