ConfigParser and dependency links

[mangin]

Hi there,
I think we have some problems with types.

here we can see that dependency_links is a list.
https://github.com/pypa/setuptools/blob/master/setuptools/dist.py#L442

here we can see that find_links is a [Tuple, str]:
https://github.com/pypa/setuptools/blob/master/setuptools/dist.py#L602

Here we are trying to join dependecy_links and second paremeter of find_links:
https://github.com/pypa/setuptools/blob/master/setuptools/dist.py#L777

Python doesn't allow to us join Str and List.
File "~.env/lib/python3.7/site-packages/setuptools/dist.py", line 777, in fetch_build_egg
links = opts['find_links'][1] + links
TypeError: can only concatenate str (not "list") to str

[mangin]

I've created an example with demonstration of problem:
https://github.com/mangin/setuptools_bug

[pganssle]

@mangin Thank you for the thorough job on your PR and creating the MWE - I realize it must have been a lot of work.

Unfortunately, I am still not entirely clear under what conditions this problem manifests. I have tried reading your MWE but it's still not 100% clear to me what features are impacted by this and what workarounds are available.

If I understand correctly, the issue arises when you have two projects that both specify dependency_links, and when you try and install either project via a path that uses easy_install, setuptools tries to join the dependency links sections together, but in some circumstances this leads to __add__ being invoked between a list and a str. I am not entirely sure what circumstances those are (is it when one project has 2 dependency links and the other has 1?).

If that is the entire scope of the issue, I think this bug is fairly low priority if not entirely wontfix, because we're in the process of actively removing easy_install and it is broken in myriad serious ways, and the PyPA is actively phasing out dependency_links entirely, in favor of PEP 508 (not sure the right link for this, maybe this issue and some of the discussions linked to it like this comment).

That said, if this merging-fields code has other uses beyond dependency links and easy install, I see no problem in fixing it for the sake of correctness even there's currently no way to trigger the bug by non-deprecated well-behaved packages.