Installation peppered with dangerous "sudo pip" / 'su -c "pip"' commands on most distros

Bug #1958784 reported by FeRD (Frank Dana)
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
HPLIP
New
Undecided
Unassigned

Bug Description

Performing pip transactions with root permissions using commands such as:

sudo pip install ...
sudo pip3 install ...
su -c "pip install ..."
su -c "pip3 install ..."
etc.

is a dangerous[1] practice[2] that is strongly[3] discouraged[4] by all major Linux distributions, by the Python Packaging Authority, by the core Python developers, and by the larger Python community as a whole. So much so, that warnings have been added[5] to the pip command in an effort to explicitly dissuade users who attempt to execute pip with root permissions. (Warnings they will not see, if hplip does it on their behalf.)

Unless it is run in a virtual environment, a root-privileged pip command will modify the distro's default Python package installation in /usr/, which is intended to be under the control of the distribution package manager.

(And if it *is* run in a virtual environment, root privileges are not required. So no matter how you slice it, '(sudo|su) pip' is never appropriate.)

Whatever reasons the hplip developers THINK they have for considering sudo/su pip appropriate for their use case... I'm sorry, but they are simply mistaken, and there is a better way to approach the problem.

All sudo/su-elevated pip commands need to be removed from installer/distros.dat.

[1]: https://pages.charlesreid1.com/dont-sudo-pip/
[2]: https://dev.to/elabftw/stop-using-sudo-pip-install-52mn
[3]: https://www.getpagespeed.com/server-setup/do-not-run-pip-as-root
[4]: https://www.reddit.com/r/Python/comments/9p2tkq/stop_using_sudo_pip_install/
[5]: https://github.com/pypa/pip/pull/9394

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.