pip does not detect circular build dependency

[ghost]

• Pip version: 10.0.devel
• Python version: any
• Operating system: any

What I've run:

pip install pip-forkbomb-test

Curiously, the problem is most severe on solid-state-drives where there is minimal lag time, so the processes multiply quickly.

[pradyunsg]

Relavant part:

[build-system]
requires = ["pip-forkbomb-test"]

I'd call this a release blocker.

[alex]

I don't think this should be a release blocker -- a package which wants to can already forkbomb you via setup.py, or by python code that you'll shortly import.

[pfmoore]

I think I agree. Is there a realistic reason to assume (given that setuptools and wheel are available as universal wheels, so pip will never try to build them from source even on systems where they are not already present) that this could come about by accident, as opposed to via explicitly constructed malicious code?

[ghost]

Note: gh-4987 resolves this issue. I don't have a position on whether this should be a release blocker (I was previously of a different opinion), but I don't see additional discussion on this issue as being helpful because it's already addressed in that PR.

[pradyunsg]

Oh, right. We still have code execution. XD

I was imagining happier days.

---

I imagine it would be possible that someone ends up with a potential build cycle and there I think it deserves an error message instead of a fork bomb. =)

Not a blocker though.