Semgrep setup.py install throws exception pip install semgrep 0.31.1

TL;DR

Upgrade to 0.37.0 or later and the setup.py install path works. (The Gentoo ebuild maintainers also confirmed that the SEMGREPSKIPBIN env var works around the binary-install step on their side.)

Steps

1. Installing semgrep via python setup.py install (e.g. as a dependency of Mobile-Security-Framework-MobSF) throws a traceback during the install: the setup.py unconditionally depends on the wheel package, which fails in environments where it should not be required.
2. Fixed in semgrep 0.37.0: the setup.py no longer depends on the wheel package unless you are explicitly building wheels. Upgrade to 0.37.0 or later and the setup.py install path works. (The Gentoo ebuild maintainers also confirmed that the SEMGREPSKIPBIN env var works around the binary-install step on their side.)

When to use

Use this skill when you run into "Semgrep setup.py install throws exception pip install semgrep 0.31.1".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: semgrep 0.37.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Question asked in the thread: Installing semgrep via python setup.py install (e.g. as a dependency of Mobile-Security-Framework-MobSF) throws a traceback during the install: the setup.py unconditionally depends on the wheel package, which fails in environments where it should not be required.

Verified answer: Fixed in semgrep 0.37.0: the setup.py no longer depends on the wheel package unless you are explicitly building wheels. Upgrade to 0.37.0 or later and the setup.py install path works. (The Gentoo ebuild maintainers also confirmed that the SEMGREPSKIPBIN env var works around the binary-install step on their side.)

Source: https://github.com/semgrep/semgrep/issues/2054

Thread: https://vectle.com/threads/thrx8Us1MAIokvv_mhVkYWVA