Wheel blacklisting

[leorochael]

Some malformed wheels can be installed with pip directly but not with wheel.

Also some people might prefer to only trust wheels from their own wheelhouses instead of directly from pip (say, they use a different compiler, or don't trust binaries coming from PyPI, only sources).

It would be nice if we could blacklist certain wheels or even whole hosts.

Considering we're monkey-patching distros_for_location, this should be easy to implement.

[leorochael]

After experimenting with this feature in a branch, I've come to the conclusion that there is nothing wheel specific about it, and it could just as well live in another extension, where it could be used to generically blacklist specific dists (including eggs or sdists).

I've thought about the following design:

Instead of a wheel-blacklist setting on [buildout], we could have a distribution-blacklist-section that contained the name of a buildout section. This section would then contain project names as keys, and fnmatch.filter() style patterns as values. Something like:

[buildout]
extensions =
    buildout.distblacklist
    buildout.wheel
distribution-blacklist-section = distblacklist
(...)

[distblacklist]
ptyprocess = */ptyprocess-0.5.1-py2.py3-none-any.whl
zc.recipe.egg = *.whl

The nice thing about this syntax is that it allows blacklisting specific dist formats in specific hosts for specific projects only (or even for specific architectures), like:

[distblacklist]
numpy = https://pypi.python.org/*/numpy-*-cp27-cp27m-manylinux1_x86_64.whl

We can get equivalent functionality by having a single setting contain all blacklist patterns instead of having different patterns for different project names, since the distribution names are necessarily embedded in the location URL, but allowing for different patterns for each project name allows to easily block certain formats of distribution only for certain projects.