[python] Automatic pip install is not working for python>=3.12 without wheel

[prabhu]

Related discussion: pypa/pip#8559

Below errors from our failed snapshot tests.

Executing /home/builder/actions-runner/_work/cdxgen/cdxgen/src_repos/genforce_3.9.21/.venv/bin/python -m pip install --disable-pip-version-check -r /home/builder/actions-runner/_work/cdxgen/cdxgen/src_repos/genforce_3.9.21/requirements.txt
About to construct the pip dependency tree based on /home/builder/actions-runner/_work/cdxgen/cdxgen/src_repos/genforce_3.9.21/requirements.txt. Please wait ...
Executing /home/builder/actions-runner/_work/cdxgen/cdxgen/src_repos/genforce_3.9.21/.venv/bin/python -m pip install --disable-pip-version-check -r /home/builder/actions-runner/_work/cdxgen/cdxgen/src_repos/genforce_3.9.21/converters/pggan_official/requirements-pip.txt
EXPERIMENTAL: Invoke cdxgen with '--feature-flags safe-pip-install' to recover a partial dependency tree for projects with build errors.
args used: [
  '-m',
  'pip',
  'install',
  '--disable-pip-version-check',
  '-r',
  '/home/builder/actions-runner/_work/cdxgen/cdxgen/src_repos/genforce_3.9.21/converters/pggan_official/requirements-pip.txt'
]
  DEPRECATION: tensorflow-gpu is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559
  error: subprocess-exited-with-error
  
  × Running setup.py install for tensorflow-gpu did not run successfully.
  │ exit code: 1
  ╰─> [18 lines of output]
      Traceback (most recent call last):
        File "<string>", line 2, in <module>
        File "<pip-setuptools-caller>", line 34, in <module>
        File "/tmp/pip-install-fbv18w6t/tensorflow-gpu_b702ae6f77df489a91e1e4f93b130876/setup.py", line 37, in <module>
          raise Exception(TF_REMOVAL_WARNING)
      Exception:
      
      =========================================================
      The "tensorflow-gpu" package has been removed!
      
      Please install "tensorflow" instead.
      
      Other than the name, the two packages have been identical
      since TensorFlow 2.1, or roughly since Sep 2019. For more
      information, see: pypi.org/project/tensorflow-gpu
      =========================================================
      
      
      [end of output]

We may have to install setuptools and wheel first, before attempting the problematic pip installs

[prabhu]

The workaround is to perform python -m pip install setuptools wheel prior to performing install -r requirements files. Bonus points if this could be done in pregen and the values of the new venv passed as environment variables.

[AnsahMohammad]

The workaround is to perform python -m pip install setuptools wheel prior to performing install -r requirements files. Bonus points if this could be done in pregen and the values of the new venv passed as environment variables.

I would like to work on this issue, would be a good starter.

Just to confirm, The issue is related to this workflow right ? (https://github.com/CycloneDX/cdxgen/blob/master/.github/workflows/snapshot-tests.yml), or is there any other workflows which may also be causing the same issue ?

[prabhu]

Thank you! Yes. It will be a lot simpler if you take one of the failing repos and try to get it working in both cli and container image mode, instead of trying to run the entire snapshot tests which takes time. If you would like to meet and discuss virtually, please drop an email to prabhu at appthreat dot dev.