Repository: pypa/setuptools

Issue:
CI should fail on deprecation warnings
It's hard for us to detect when we are using deprecated code, which allows things like #1798 to go undetected for a long time. In `dateutil` [I treat all warnings as errors](https://github.com/dateutil/dateutil/blob/master/setup.cfg#L55-L58) so that we can actually *heed* the warnings that are being raised by my upstream dependencies.

I think we should do the same thing here. I tried enabling warnings-as-errors on #1798 and it actually worked for a few days, then [`bdist_wininst`](https://discuss.python.org/t/deprecate-bdist-wininst/1929) was deprecated breaking us on the dev build of CPython. I think we should remove our use of `bdist_wininst` or suppress the warning then enable warnings-as-errors.


Discussion:
I basically agree with all of that. Happy to enforce no warnings. Even better is to have a clear guidance on how to suppress errors/warnings when the emerge and to file a corresponding ticket to address the deprecation. Perhaps that guidance could go here.

I imagine something like: 

> When encountering an error from a Warning:
> 1. File a ticket including the text from the failure.
> 2. Suppress the warning by adding an entry to pytest.ini, including a link to the ticket.

Can we test a process like that with `bdist_wininst`?
@jaraco How granular can we make the specifications in `pytest.ini`? I've only ever filtered by warning class, which would mean disabling the warnings for all of `DeprecationWarning` in this case, which would be undesirable. I think this would be a good test to demonstrate that the `pytest.ini` approach would work.
[Pytest supports the same syntax](https://docs.pytest.org/en/latest/warnings.html) as the the [`-W` argument to Python](https://docs.python.org/3/using/cmdline.html#cmdoption-w), which allows for arbitrary granularity, including module and line number. For example, here are [some warnings I suppress as a matter of course](https://github.com/jaraco/skeleton/blob/174f0fd7cf349c277ade401ddb88dde530723053/pytest.ini#L6-L11).

I think the filter we want is `ignore:distutils.command.bdist_wininst::command is deprecated` (specific and pretty clear). It would be sensitive if the message changed not to include that string, but that seems unlikely.
With 9fd5451, the tests now run on Python 3.8 with `tox -- -W error`.

Resolving patch:
diff --git a/pkg_resources/__init__.py b/pkg_resources/__init__.py
--- a/pkg_resources/__init__.py
+++ b/pkg_resources/__init__.py
@@ -1235,12 +1235,13 @@ def _warn_unsafe_extraction_path(path):
         mode = os.stat(path).st_mode
         if mode & stat.S_IWOTH or mode & stat.S_IWGRP:
             msg = (
-                "%s is writable by group/others and vulnerable to attack "
-                "when "
-                "used with get_resource_filename. Consider a more secure "
+                "Extraction path is writable by group/others "
+                "and vulnerable to attack when "
+                "used with get_resource_filename ({path}). "
+                "Consider a more secure "
                 "location (set with .set_extraction_path or the "
-                "PYTHON_EGG_CACHE environment variable)." % path
-            )
+                "PYTHON_EGG_CACHE environment variable)."
+            ).format(**locals())
             warnings.warn(msg, UserWarning)
 
     def postprocess(self, tempname, filename):


Test patch: