[Pythonmac-SIG] Package manager notes

[amk at amk.ca]

Bob Ippolito let me know about the package manager discussion.  I'm still
reading through the past thread.  Some quick notes:

* I'm happy to revive PEP 262 for Python 2.4.  

  My laptop died recently, and the required switch to a new machine that
  didn't have Quixote + mxBase + RDFlib + PyXML installed reminded me of why
  an installer would be useful.  If we built Python packages for every
  platform, we wouldn't need a Python-specific database, but no one is
  building these packages, so getting all those packages installed is a
  pain.
  
* This might be a good time to work on a package database; there are various
  other things that could be fixed in Distutils, and maybe it's time for a
  Distutils 2.0.

* Regarding version comparisons: distutils.version has LooseVersion and
  StrictVersion classes that parse and compare version numbers.   See the 
  module's docstrings for details.
  
* Note that PyCrypto doesn't help with verifying SSL server certificates;
  these are two different levels, and complicated tasks like ASN.1 parsing
  separate them.  We could either fix the socket module to support server
  certificate verification, or we could use bits of PyCrypto to 
  check signatures on a file.
  
  It would be possible to include a signature-only algorithm such as 
  DSA in Python, subject to Guido's veto, but that's a non-trivial amount of
  packaging work, though, because it would need infrastructure for 
  generating prime numbers, etc.

--amk