pkg_resources.safe_name() is not PEP 503 complient

[StephanErb]

PEP 503 states that:

[T]he only valid characters in a name are the ASCII alphabet, ASCII numbers, ., -, and _.
The name should be lowercased with all runs of the characters ., -, or _ replaced with a
single - character.

This is implemented differently in pkg_resources.safe_name(). The . (dot) should be replaced by - (hyphen) but isn't. This is causing unexpected behaviour in projects such as pip (e.g. pypa/pip#5021)

There is a little room for interpretation here, as PEP 426 does not require . to be replaced by -. However packaging.utils.canonicalize_name implements this by replacing . with - as well.

I therefore believe pkg_resources should to do the same.

[benoit-pierre]

Until pkg_resources if effectively split from setuptools, the right place to fill a bug about it is still there.

[StephanErb]

Ah, this explains why it is so quiet over here. Thanks :)

[StephanErb]

Before anybody wonders: I just decided not to file the issue over at setuptools. PEP 503 is aimed for PyPI and friends. Changing the behaviour in setuptools would break too many things.

[pradyunsg]

@StephanErb pypa/warehouse then?

[pradyunsg]

Nvm me.