Fix installing setup dependencies on newer versions of pip

Author: ashovlin

.changes/next-release/enhancement-bundledinstaller-63856.json

@@ -0,0 +1,5 @@
+{
+  "type": "bugfix",
+  "category": "bundled-installer",
+  "description": "Fix installing setup dependencies on newer versions of pip"
+}

scripts/install

@@ -149,7 +149,7 @@ def pip_install_packages(install_dir):
 
     with cd(PACKAGES_DIR):
         run(
-            '{} -m pip install {} --find-links file://{} {}'.format(
+            '{} -m pip install {} --find-links {} {}'.format(
                 python, INSTALL_ARGS, PACKAGES_DIR, cli_tarball
             )
         )
@@ -159,24 +159,17 @@ def _install_setup_deps(python, setup_package_dir):
     # Some packages declare `setup_requires`, which is a list of dependencies
     # to be used at setup time. These need to be installed before anything
     # else, and pip doesn't manage them.  We have to manage this ourselves
-    # so for now we're explicitly installing the one setup_requires package
-    # we need.  This comes from python-dateutils.
-    setuptools_scm_tarball = _get_package_tarball(
-        setup_package_dir, 'setuptools_scm'
-    )
-    run(
-        (
-            '{} -m pip install --no-binary :all: --no-cache-dir --no-index '
-            '--find-links file://{} {}'
-        ).format(python, setup_package_dir, setuptools_scm_tarball)
-    )
-    wheel_tarball = _get_package_tarball(setup_package_dir, 'wheel')
-    run(
-        (
-            '{} -m pip install --no-binary :all: --no-cache-dir --no-index '
-            '--find-links file://{} {}'
-        ).format(python, setup_package_dir, wheel_tarball)
-    )
+    # so for now we're explicitly installing setuptools_scm which is needed for
+    # python-dateutils. We're also now installing setuptools since its no
+    # longer installed alongside pip for 3.12+.
+    for package in ['setuptools-', 'wheel', 'setuptools_scm']:
+        # these are actually wheels, but the bundle lookup logic is the same
+        tarball = _get_package_tarball(setup_package_dir, package)
+        run(
+            '{} -m pip install {} --find-links {} {}'.format(
+                python, INSTALL_ARGS, PACKAGES_DIR, tarball
+            )
+        )
 
 
 def create_symlink(real_location, symlink_name):

scripts/make-bundle

@@ -33,8 +33,9 @@ PINNED_RUNTIME_DEPS = [
     ('colorama', '0.4.5'),
 ]
 BUILDTIME_DEPS = [
+    ('setuptools', '75.3.2'),  # 75.4 dropped 3.8 support
     ('setuptools-scm', '3.3.3'),
-    ('wheel', '0.33.6'),
+    ('wheel', '0.45.1'),  # 46.0 dropped 3.8 support
 ]
 PIP_DOWNLOAD_ARGS = '--no-build-isolation --no-binary :all:'
 
@@ -84,6 +85,16 @@ def download_package_tarballs(dirname, packages):
             ))
 
 
+def download_package_wheels(dirname, packages):
+    with cd(dirname):
+        for package, package_version in packages:
+            run(
+                '%s -m pip download %s==%s --no-build-isolation '
+                '--only-binary :all:'
+                % (sys.executable, package, package_version)
+            )
+
+
 def download_cli_deps(scratch_dir, packages):
     # pip download will always download a more recent version of a package
     # even if one exists locally. The list of packages supplied in `packages`
@@ -174,9 +185,10 @@ def main():
     # manually install them. We isolate them to a particular directory so we
     # can run the install before the things they're dependent on. We have to do
     # this because pip won't actually find them since it doesn't handle build
-    # dependencies.
+    # dependencies. We use wheels for this, to avoid bootstrapping setuptools
+    # in 3.12+ where its no longer included by default.
     setup_dir = os.path.join(package_dir, 'setup')
-    download_package_tarballs(
+    download_package_wheels(
         setup_dir,
         packages=BUILDTIME_DEPS,
     )