don't assume vendor {distribute,pip} are writeable