Bug 2014513

Since pip 21.3, users who upgrade pip via pip will have a pip that installs packages to /usr/lib(64)/python3.10/site-packages/ instead of /usr/local/lib(64)/python3.10/site-packages/.

-----------------------------

Since Fedora 27, pip installs packages to /usr/local/lib(64)/python3.10/site-packages/ by default:

https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe

This also happens when users install/upgrade pip via pip, because our patch lives in the Python standard library and not pip.


However, pip 21.3+ uses sysconfig on Python 3.10+ instead of previously used distutils and hence users who upgrade pip to 21.3 or greater on Fedora 35 will have a pip that is no longer safe.


pip-installed pip 21.2.3:

[root@dde39f841e21 /]# pip install pello
Collecting pello
  Using cached Pello-1.0.2-py3-none-any.whl (6.0 kB)
Installing collected packages: pello
Successfully installed pello-1.0.2

[root@dde39f841e21 /]# pip uninstall pello
Found existing installation: Pello 1.0.2
Uninstalling Pello-1.0.2:
  Would remove:
    /usr/local/bin/pello_greeting
    /usr/local/lib/python3.10/site-packages/Pello-1.0.2.dist-info/*
    /usr/local/lib/python3.10/site-packages/pello/*
Proceed (Y/n)?


pip-installed pip 21.3:

[root@dde39f841e21 /]# pip install pello
Collecting pello
  Downloading Pello-1.0.2-py3-none-any.whl (6.0 kB)
Installing collected packages: pello
Successfully installed pello-1.0.2

[root@dde39f841e21 /]# pip uninstall pello
Found existing installation: Pello 1.0.2
Uninstalling Pello-1.0.2:
  Would remove:
    /usr/bin/pello_greeting
    /usr/lib/python3.10/site-packages/Pello-1.0.2.dist-info/*
    /usr/lib/python3.10/site-packages/pello/*
Proceed (Y/n)?



Note that especially users who pip-upgrade their pip are likely to brick their systems by running more sudo pip installs.




This is not a big problem on Fedora 33/34, because it only affects Python 3.10+ and system tools run on 3.9 there.

This is not an issue on Fedora 36 at all, because we have switched the patch to syscofnig: https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/AAGUFQZ4RZDU7KUN4HA43KQJCMSFR3GW/


We could do that on Feodra 35 as well, but it is not very backward compatible, so we should figure out a better solution.