[04:15:09] <dstufft> r1chardj0n3s: no, it doesn't do that, and I'm not sure we should. sounds like a good way to accidently leak information from the machine it's running on
[04:15:10] <r1chardj0n3s> (I'm avoidning reading the TUF paper and PEPs ;)
[04:15:21] <dstufft> but since readme is an external lib
[04:15:26] <dstufft> it can do that when run locally
[04:16:08] <r1chardj0n3s> readme handles the markdown security holes?
[04:17:41] <dstufft> r1chardj0n3s: readme doesn't handle markdown at all currently (and I do't think PyPI should without a way to mark that you want markdown, the fallback thing seems like a bad idea to me), but readme can handle raw HTML safely
[04:18:08] <dstufft> it doesn't rely on the render-er to emit safe html
[04:18:12] <r1chardj0n3s> I think markdown in the face of a README.md is fine, but anything else isn't ;)
[04:18:34] <r1chardj0n3s> that's right, you sanitise post-render
[04:19:41] <dstufft> r1chardj0n3s: the problem is, that while PyPI can see a README.md, the metadata that PyPI makes available to everyone else via the API doesn't have a way to specify it's markdown
[04:20:35] <dstufft> and the fallback thing doesn't work very well, because there is a non trivial portion of markdown that also renders successfully as rst (but renders wrongly)
[04:20:51] <r1chardj0n3s> ok, I am 99.9% sure that even though I've pushed and confirmed the code push to the three web nodes they are not running the new code with the code-block fix
[04:21:11] <dstufft> so people using markdown will end up needing to use something that's not valid rst
[04:23:47] <r1chardj0n3s> now I'll PR that fix to production
[04:25:58] <dstufft> r1chardj0n3s: I'm also going to look at the rendering settings github uses for README.rst to and see if we can steal anything for readme too
[04:26:26] <dstufft> they have a lib similar to readme for their README.ext code
[04:27:32] <dstufft> I know one thing is some code so that svg images render using the <img> tag instead of the <object> tag
[04:27:44] <r1chardj0n3s> imma give salt a chance to update prod for a bit, and go back to this horrible presentation I'm giving soon. why on Earth did I decide that talking about Python Packaging for 45 minutes would be a good idea? :)
[04:28:11] <dstufft> because docutils uses the <object> tag, but when you render svg using the <object> tag the svg gets to execute javascript (who on earth thought an image needed the ability to render javascript)
[04:28:29] <dstufft> r1chardj0n3s: probably for the same reason you thought writing a package index was a good idea
[04:28:30] <r1chardj0n3s> hey, svg with js is awesome ;)
[04:28:43] <r1chardj0n3s> yeah and now I get to read the TUF academic paper *again*
[04:28:55] <r1chardj0n3s> (because it is SO DULL that LITERALLY NONE OF IT STAYED IN MY BRAIN)
[04:29:01] <dstufft> r1chardj0n3s: ha, that's on my list of things to read this week too
[04:29:25] <r1chardj0n3s> and really, how did they get away with this in an academic paper "We use the term PKI to refer to contemporary PKI based on third-party CAs. Our design includes what is, in fact, a public key infrastructure. To avoid ambiguity, we will not refer to it as a PKI."
[04:29:44] <dstufft> r1chardj0n3s: if you want, I'm happy to do whatever on that PEP, I'm super opiniated about cryptography heh
[04:29:54] <dstufft> I'm going to be reading it and making sure it makes sense regardless
[04:30:00] <r1chardj0n3s> I am fully expecting you to :)
[04:30:14] <r1chardj0n3s> Imma not signing off on a PEP I don't understand tho :)
[04:32:46] <ionelmc> dstufft: how sorry? did it got you hooked? :-)
[04:33:05] <r1chardj0n3s> wait. pygments.rb piped out to python to do the rendering!?
[04:33:06] <dstufft> r1chardj0n3s: because virtualenv is almost 100% code that is super hard to understand, full of hacks which most of them I don't think is even needed anymore, and the way it works we've got a series of bugs that any fix for one of the bugs seems to regress the other bugs so the fixes are mutually exlcusive
[04:33:21] <dstufft> r1chardj0n3s: so does their rst rendering
[04:33:28] <r1chardj0n3s> dstufft: yes, but surely you could just call upon the Twitters for someone else do rewrite it? :)
[04:34:00] <ionelmc> dstufft: so did you got any progress?
[04:34:21] <dstufft> r1chardj0n3s: meh, I did most of it on christmas even and I haven't touched it again till today, so 2 days in I have something that mostly works (it uses the venv module on 3.3+, and legacy hacks on < 3.3)
[04:45:12] <r1chardj0n3s> so github random generator then
[04:45:26] <dstufft> sort of a "try this refactor of virtualenv because we changed all the things and want some testing before we bless it as virtualenv"
[04:45:31] <ionelmc> dstufft: should i try it on windows?
[04:45:33] <r1chardj0n3s> I got "flaming-shame" for my bower-to-xstatic package generator code
[04:46:03] <dstufft> ionelmc: if you want! It will probably fail since I haven't tried to do anything windows at all with it yet
[04:46:39] <ionelmc> dstufft: there's no "copy" support right?
[04:46:52] <dstufft> ionelmc: to copy one venv to a different location?
[04:47:15] <ionelmc> dstufft: windows doesn't have os.link for the older pythons
[04:47:31] <dstufft> oh you mean does it use symlinks or whatever?
[07:35:40] <dstufft> it takes whatever the normal paths are, and turns them into global paths
[07:37:48] <ionelmc> dstufft: well technically it doesn't add them, it just filters them
[07:37:56] <dstufft> ionelmc: https://github.com/dstufft/virtualenv/blob/rewrite/virtualenv/builders/legacy.py#L28-L49 this part should turn the virtualenv stdlib paths into the global paths
[07:38:19] <ionelmc> but paths beginning with sys.prefix arent't in sys.path to begin with
[07:38:47] <ionelmc> dstufft: yes, that's exactly where i'm looking
[07:39:37] <dstufft> on my OSX box, what was in sys.path to start with, were paths like /path/to/virtualenv/lib/python2.7/
[07:39:50] <dstufft> and I wanted those to be /path/to/real/python/lib/python2.7/
[17:22:57] <ionelmc> because the functionality actual path setup functionality is not in it it creates problems when you try to create a virtualenv from within a virtualenv
[17:23:20] <sigmavirus24> ionelmc: people do that?
[17:23:26] <dstufft> the virtualenv within a virtualenv has a different solution
[17:26:01] <dstufft> I only recently started doing that though
[17:26:01] <sigmavirus24> I use it on too many projects for that not to be the convenient way of handling it
[17:26:17] <dstufft> mostly because I got annoyed of creating per-projects venvs that only ever contained tox
[17:26:46] <dstufft> since 99% of the time when I want to import something and test it I use mktmpenv
[17:27:45] <dstufft> ionelmc: there are ~solutions~ to the platform specific thing, might be able to figure something out using sys.base_exec_prefix + sys.executable, or at the worst just stash the "real" sys.executable somewhere inside the virtual environment
[17:28:28] <ionelmc> dstufft: trouble i need that from the legacy virtualenv
[17:28:44] <ionelmc> actually, let me show you what i'm talking about
[17:29:15] <dstufft> honestly I might just raise a RuntimeError("Sorry, delete your old ass virtualenv and create a new one") unless it's not very hard to do it
[17:29:31] <ionelmc> dstufft: so i've added some preliminary integration test: https://github.com/dstufft/virtualenv/pull/2/files#diff-7eb47fc18d4a6196f0940784484a5bf3R1
[17:29:54] <ionelmc> trouble is, that runs within tox's virtualenv
[17:30:25] <ionelmc> so i'd get a failure like this:
[17:31:28] <ionelmc> dstufft: because this code here https://github.com/pypa/virtualenv/pull/691/files#diff-6daf600e64837c3e89feaf855d0b8fc3R135 expects a non-virtualenv environment