Hi!

python-pip 25.3+dfsg-1 is causing other packages to FTBFS, if they build-depends on python3-pip. 25.2+dfsg-1 was good.

It seems that pip keeps trying to connect to the internet even though sbuild won't allow it. Then pip will just fail, throwing "could not find a version that satisfies the requirement xxxxxxxx", even though the correct debian packages were installed.

E.g., libselinux, FTBFS now as of 2025-11-21 with python-pip 25.3+dfsg-1 (but was fine with 25.2+dfsg-1):


make[2]: Leaving directory '/build/reproducible-path/libselinux-3.9'
CFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2 -D_LARGEFILE64_SOURCE -D_LARGEFILE64_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/libselinux-3.9=. -flto=auto -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -fno-semantic-interposition -Wall -Wextra -Wdate-time -D_FORTIFY_SOURCE=2 -D_LARGEFILE64_SOURCE -D_LARGEFILE64_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I../include -D_GNU_SOURCE -DNO_ANDROID_BACKEND -DUSE_PCRE2 -DPCRE2_CODE_UNIT_WIDTH=8 -DHAVE_STRLCPY -DHAVE_REALLOCARRAY -Wno-error -Wno-unused-variable -Wno-unused-but-set-variable -Wno-unused-parameter -Wno-shadow -Wno-uninitialized -Wno-missing-prototypes -Wno-missing-declarations -Wno-deprecated-declarations" python3.13 -m pip install --prefix=/usr `test -n "/build/reproducible-path/libselinux-3.9/debian/tmp" && echo --root /build/reproducible-path/libselinux-3.9/debian/tmp --ignore-installed --no-deps`  .
WARNING: The directory '/sbuild-nonexistent/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Processing /build/reproducible-path/libselinux-3.9/src
  Installing build dependencies: started
  Installing build dependencies: finished with status 'error'
  error: subprocess-exited-with-error

  × installing build dependencies did not run successfully.
  │ exit code: 1
  ╰─> [8 lines of output]
      WARNING: The directory '/sbuild-nonexistent/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
      WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7fe291825940>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution')': /simple/setuptools/
      WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7fe291a020d0>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution')': /simple/setuptools/
      WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7fe291a02350>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution')': /simple/setuptools/
      WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7fe291a025d0>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution')': /simple/setuptools/
      WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7fe291a02850>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution')': /simple/setuptools/
      ERROR: Could not find a version that satisfies the requirement setuptools>=40.8.0 (from versions: none)
      ERROR: No matching distribution found for setuptools>=40.8.0
      [end of output]

  note: This error originates from a subprocess, and is likely not a problem with pip.
ERROR: Failed to build 'file:///build/reproducible-path/libselinux-3.9/src' when installing build dependencies
make[3]: *** [Makefile:201: install-pywrap] Error 1
make[3]: Leaving directory '/build/reproducible-path/libselinux-3.9/src'
make[2]: *** [Makefile:68: install-pywrap] Error 2
make[2]: Leaving directory '/build/reproducible-path/libselinux-3.9'
make[1]: *** [debian/rules:73: install-python-3.13] Error 2
make[1]: Leaving directory '/build/reproducible-path/libselinux-3.9'
make: *** [debian/rules:44: binary-arch] Error 2
dpkg-buildpackage: error: debian/rules binary-arch subprocess returned exit status 2

Hi Luke (2025.11.21_12:07:21_+0000)

I'm afraid this is because you are using a deprecated mode of pip.

I don't think pip is particularly suited to the use that libselinux has
for it. It's meant as an end-user package installer, not a build tool.
These days there is a separate build tool, "build" that we use for our
Python packaging. My recommendation would be to use that (via pybuild)
wherever possible.

If you look at your last build, you'll see:

That's the deprecation that was enacted now.

If you want to continue to use pip, you can explicitly specify
--use-pep517. You'll need --no-build-isolation too, to be able to do 
this without downloading code from the Internet.

But... as I said, this isn't the recommended path.

Stefano