Package doesn't install nicely on Python 3.9

[MijnheerD]

I was trying to install the latest version in my Python 3.9 virtual environment, but kept getting this error:

ImportError: urllib3 v2.0 only supports OpenSSL 1.1.1+

Even though I downgraded my urllib package to version 1.26.6. After digging around for a while I managed to track down the issue to the project's TOML file. With TOML files, an isolated build environment is created. In this build environment, urllib v2.0+ was installed, leading to the crash. A simple fix for this is to add the build requirement "urllib3 < 2.0".

Can this be added or does this potentially cause (security) issues?

[cg-laser]

I don't understand this issue. We do not use urllib nor OpenSSL. As a matter of fact, we do not define any dependencies in the toml file. I don't see how your error can be related to radiotools.

[MijnheerD]

This came up when I tried to install radiotools on our cluster, where a lower version of OpenSSL is installed. This means that one has to restrict the urllib package version to below 2.0, because in that release support for OpenSSL < 1.1.1 was dropped (see this issue: urllib3/urllib3#2168).

However, it is not enough to do this in ones (virtual) environment. When I did a pip list, a compatible version of urllib was installed, but I kept getting this error. After a while I tracked down the issue: with a pyproject.toml file, the package is built inside a new, temporary virtual environment. And by default urllib v2.0 gets installed inside this build environment. The build requirement "urllib3 < 2.0" ensures this does not happen.

I am guessing there might be more people that want to install radiotools in environment with an OpenSSL version below 1.1.1, so I am proposing to add the requirement to the toml file. As you say, radiotools does not actually use urllib, so it is purely a trick to ensure the build environment is compatible with more systems.

[cg-laser]

sry, I still don't get the problem, because openSSL is also not a requirement. It feels weird to request packages that are not used. The only dependencies are numpy and scipy. I don't know why a pip install radiotools would install urllib or openssh at all.
And shouldn't NuRadioMC have the same problem?

[MijnheerD]

I was also very confused when I had this issue. The problem is that on Python 3.9 (at least, maybe this is also true for earlier versions) urllib v2.0 is the standard. So my understanding is that when the build backend is created (I believe this is flit for radiotools), a new virtual environment is spun up. In this environment, urllib is installed by default (I don't know why, I think it is simply part of the core Python library?) and for Python 3.9, the version defaults to 2.0 or higher. If you happen to be an a system which does not have OpenSSL 1.1.1+, the build crashes.

The only way to influence the build backend, is by using the build requirements, so that is why I am suggesting this change. In the end I resorted to creating a setup.py file on our cluster to get radiotools installed in my venv. This could be another solution, to provide a setup file one could resort to if the pyproject.toml does not work.

I guess NuRadioMC will have the same issue, but I did not try to install that package on the same cluster. The other environments where I installed NRMC did have OpenSSL 1.1.1 or higher, so the issue did not arise.

[cg-laser]

it seem that this is rather a general pip problem that would apply to any package. Therefore, I don't think we can fix this in radiotools.
BTW: You don't need to install radiotools, you can also just clone the repository and add its path to PYTHONPATH.