+++ This bug was initially created as a clone of Bug #1320683 +++

With Python packages the distutils setup.py acts much like an RPM spec file, it contains all sorts of metadata about the package. One critical piece of information is the required dependencies, including required versions of those dependencies.

For example in the requests.oauthlib setup.py file we have:

    install_requires=['oauthlib>=0.6.2', 'requests>=2.0.0']

But the RPM spec file does not enforce the same dependencies. The dependencies in the spec files are this:

For Py2:

Requires:           python-oauthlib
Requires:           python-requests

For Py3:

Requires:           python3-oauthlib
Requires:           python3-requests

The dependencies in the RPM *must* match those declared in the upstream metadata otherwise an install may not produce runnable code. This is the problem we're seeing with some distributions.

oauthlib 0.6.2 exposed new method oauthlib.oauth2.is_secure_transport(), requests-oauthlib references that symbol. But if a version of oauthlib older than 0.6.2 is installed the package installer won't force an update of oauthlib because of the missing version dependency.

The result is the python program aborts.