Why does Pip ignore conflicting dependencies?

Question

If I create a dummy package -- here's /tmp/example_package/setup.py (note the requirements):

from distutils.core import setup

setup(name='my_project',
      description="Just a test project",
      version="1.0",
      py_modules=['sample'],
      install_requires=['requests > 0.12'])

Here's /tmp/example_package/sample.py:

import requests

def get_example():
    return requests.get("http://www.example.com")

Now, I create a virtualenv:

$ virtualenv /tmp/foobar --distribute -p python2.7
Running virtualenv with interpreter /usr/bin/python2.7
New python executable in /tmp/foobar/bin/python2.7
Also creating executable in /tmp/foobar/bin/python
Installing distribute.................................................................................................................................................................................................done.
Installing pip................done.
$ source /tmp/foobar/bin/activate

I create a requirements.pip with conflicting requirements:

# this requires requests > 0.12:
file:///tmp/example_package

# but this conflicts:
requests==0.9.0

Pip happily installs this:

$ pip install -r requirements.pip                                                                                                                                                                       [18:40:10]
Unpacking ./example_package
  Running setup.py egg_info for package from file:///tmp/example_package

Downloading/unpacking requests==0.9.0 (from -r requirements.pip (line 3))
  Downloading requests-0.9.0.tar.gz (55Kb): 55Kb downloaded
  Running setup.py egg_info for package requests

Downloading/unpacking certifi>=0.0.4 (from requests==0.9.0->-r requirements.pip (line 3))
  Downloading certifi-0.0.8.tar.gz (118Kb): 118Kb downloaded
  Running setup.py egg_info for package certifi

Installing collected packages: requests, my-project, certifi
  Running setup.py install for requests

  Running setup.py install for my-project

  Running setup.py install for certifi

Successfully installed requests my-project certifi
Cleaning up...

Why does Pip allow this? My example_package won't work, because its requirements aren't met.

Answer 1

This is a limitation of Pip. The requirements file trumps the requirements of the packages. See https://github.com/pypa/pip/issues/775#issuecomment-12748095

Answer 2

Looking at the pip source it seems like it should recursively add all the requirements to one big RequirementSet... and then crash out with a 'Duplicate requirement' exception...

Hmm.. are you sure your setup.py is correct?

Distutils has a requires keyword but not install_requires: http://docs.python.org/2/distutils/setupscript.html#relationships-between-distributions-and-packages

SO answers which reference this:
https://stackoverflow.com/a/10686196/202168
https://stackoverflow.com/a/13468644/202168