为x install添加类pipx的支持以适应Python的安全策略？ #257

ydrk12 · 2025-06-16T18:03:57Z

ydrk12
Jun 16, 2025

这条disscussion从issue#256迁移而来。

✅ Checklist

I am using the latest version

💬 Describe the bug

就是典型的error: externally-managed-environment这个错误，完整的错误文本如下：

error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
    python3-xyz, where xyz is the package you are trying to
    install.

    If you wish to install a non-Debian-packaged Python package,
    create a virtual environment using python3 -m venv path/to/venv.
    Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
    sure you have python3-full installed.

    If you wish to install a non-Debian packaged Python application,
    it may be easiest to use pipx install xyz, which will manage a
    virtual environment for you. Make sure you have pipx installed.

    See /usr/share/doc/python3.12/README.venv for more information.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.

📄 System

- name: x-cmd
  info: |-
    ___X_CMD_VERSION:           .6e004e07
    ___X_CMD_PKG_VERSION:       v0.1.2
    ___X_CMD_WEBSRC_REGION:     cn
    ___X_CMD_LANG:              en
    x-cmd sum:                  6e004e0720f5be1b2aba0285e73a8f8e4ec6827432a7f6830405911679a514f7caadff4b6c4b5642d4b05dbb35dccb121e02e6a112fe95f6d89daffce6297c0d

    ==== root ls ====
    V:          <<HOME-STRING>>/.x-cmd.root/v
    ROOT:       <<HOME-STRING>>/.x-cmd.root
    CODE:       <<HOME-STRING>>/.x-cmd.root/v/.6e004e07
    ADV:        <<HOME-STRING>>/.x-cmd.root/v/.6e004e07/adv
    MOD:        <<HOME-STRING>>/.x-cmd.root/v/.6e004e07/mod
    METADATA:   <<HOME-STRING>>/.x-cmd.root/v/.6e004e07/.x-cmd/metadata
    GDATA:      <<HOME-STRING>>/.x-cmd.root/global/data
    DATA:       <<HOME-STRING>>/.x-cmd.root/local/data
    USR:        <<HOME-STRING>>/.x-cmd.root/local/usr
    ART:        <<HOME-STRING>>/.x-cmd.root/local/art
    GCFG:       <<HOME-STRING>>/.x-cmd.root/global/cfg
    CFG:        <<HOME-STRING>>/.x-cmd.root/local/cfg
    LOG:        <<HOME-STRING>>/.x-cmd.root/local/log
    CACHE:      <<HOME-STRING>>/.x-cmd.root/local/cache
    TMP:        <<HOME-STRING>>/.x-cmd.root/local/tmp
    SHARED:     <<HOME-STRING>>/.x-cmd.root/global/shared

    ==== boot rc ====
- name: shell
  info: bash
- name: awk
  info: GNU Awk 5.2.1, API 3.2, PMA Avon 8-g1, (GNU MPFR 4.2.1, GNU MP 6.3.0)
- name: sed
  info: |-
    /usr/bin/sed (GNU sed) 4.9
    Packaged by Debian
    Copyright (C) 2022 Free Software Foundation, Inc.
    License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Written by Jay Fenlason, Tom Lord, Ken Pizzini,
    Paolo Bonzini, Jim Meyering, and Assaf Gordon.

    This sed program was built with SELinux support.
    SELinux is disabled on this system.

    GNU sed home page: <https://www.gnu.org/software/sed/>.
    General help using GNU software: <https://www.gnu.org/gethelp/>.
    E-mail bug reports to: <[email protected]>.
- name: grep
  info: |-
    grep (GNU grep) 3.11
    Copyright (C) 2023 Free Software Foundation, Inc.
    License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Written by Mike Haertel and others; see
    <https://git.savannah.gnu.org/cgit/grep.git/tree/AUTHORS>.

    grep -P uses PCRE2 10.42 2022-12-11
- name: find
  info: |-
    find (GNU findutils) 4.9.0
    Copyright (C) 2022 Free Software Foundation, Inc.
    License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Written by Eric B. Decker, James Youngman, and Kevin Dalley.
    Features enabled: D_TYPE O_NOFOLLOW(enabled) LEAF_OPTIMISATION FTS(FTS_CWDFD) CBO(level=2)
- name: busybox
  info:
- name: curl
  info: |-
    curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/8.5.0 OpenSSL/3.0.13 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libidn2/2.3.7 libpsl/0.21.2 (+libidn2/2.3.7) libssh/0.10.6/openssl/zlib nghttp2/1.59.0 librtmp/2.3 OpenLDAP/2.6.7
    Release-Date: 2023-12-06, security patched: 8.5.0-2ubuntu10.6
    Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
    Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd
- name: wget
  info: |-
    GNU Wget 1.21.4 built on linux-gnu.

    -cares +digest -gpgme +https +ipv6 +iri +large-file -metalink +nls
    +ntlm +opie +psl +ssl/openssl

    Wgetrc:
        /etc/wgetrc (system)
    Locale:
        /usr/share/locale
    Compile:
        gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc"
        -DLOCALEDIR="/usr/share/locale" -I. -I../../src -I../lib
        -I../../lib -Wdate-time -D_FORTIFY_SOURCE=3 -DHAVE_LIBSSL -DNDEBUG
        -g -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer
        -ffile-prefix-map=/build/wget-LWnKWI/wget-1.21.4=. -flto=auto
        -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection
        -Wformat -Werror=format-security -fcf-protection
        -fdebug-prefix-map=/build/wget-LWnKWI/wget-1.21.4=/usr/src/wget-1.21.4-1ubuntu4.1
        -DNO_SSLv2 -D_FILE_OFFSET_BITS=64 -g -Wall
    Link:
        gcc -DHAVE_LIBSSL -DNDEBUG -g -O2 -fno-omit-frame-pointer
        -mno-omit-leaf-frame-pointer
        -ffile-prefix-map=/build/wget-LWnKWI/wget-1.21.4=. -flto=auto
        -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection
        -Wformat -Werror=format-security -fcf-protection
        -fdebug-prefix-map=/build/wget-LWnKWI/wget-1.21.4=/usr/src/wget-1.21.4-1ubuntu4.1
        -DNO_SSLv2 -D_FILE_OFFSET_BITS=64 -g -Wall -Wl,-Bsymbolic-functions
        -flto=auto -ffat-lto-objects -Wl,-z,relro -Wl,-z,now -lpcre2-8
        -luuid -lidn2 -lssl -lcrypto -lz -lpsl ../lib/libgnu.a

    Copyright (C) 2015 Free Software Foundation, Inc.
    License GPLv3+: GNU GPL version 3 or later
    <http://www.gnu.org/licenses/gpl.html>.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Originally written by Hrvoje Niksic <[email protected]>.
    Please send bug reports and questions to <[email protected]>.
- name: release
  info: |-
    Ubuntu
    24.04
    noble

🔎 To Reproduce

Start up service: ...
Type command: x i

Expected behavior

x i
- I|install: Selected software -> [tempy]
- I|install: Running the code
  more:
    code: pip install git+https://github.com/noprobelm/tempy
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
    python3-xyz, where xyz is the package you are trying to
    install.

🗂️ Additional Context

其实如果只是我自己想用pip命令出现这个错误解决起来是很简单的，因为这个东西太经典太广泛了，据说是Python大概在3.11左右的版本之后引入的安全策略，阻止用户通过pip命令安装包，以防止同系统本身的包管理系统相互冲突，例如pacman apt yum一类的。

个人层面，可以通过以下命令直接删除掉警告从而使得这个命令能够照常运行

sudo mv /usr/lib/python3.x/EXTERNALLY-MANAGED /usr/lib/python3.x/EXTERNALLY-MANAGED.bk

但是我并不是精通开发的开发者，而只是一个GNU/linux用户，无法评估这种粗暴的做法会不会产生额外的风险。

另外的一些替代方法，按我自己能找到和想到的包括但不限于用pipx平替pip命令，用venv环境一类的，
但是我提出这个issue的用意是提醒开发者，既然x-cmd作为一种各种命令方便的集成工具，是不是应该应该考虑采取措施避免类似情况的发生？

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

为x install添加类pipx的支持以适应Python的安全策略？ #257

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

为x install添加类pipx的支持以适应Python的安全策略？ #257

Uh oh!

ydrk12 Jun 16, 2025

✅ Checklist

💬 Describe the bug

📄 System

🔎 To Reproduce

Expected behavior

🗂️ Additional Context

Replies: 0 comments

ydrk12
Jun 16, 2025