Python installation options for Windows

Steve Dower took over the maintenance of the installer for Python on Windows a year ago, just after PyCon 2014. Since then, he has gotten a lot of feedback that the installer is not doing what is needed. He spoke at a 2015 Python Language Summit session to explain what the installer is doing and to describe some scenarios that it might support.

The Windows installer for Python 3.4 and earlier had a rather large security hole in that it allowed any user to modify the system Python installation. Dower has fixed that for the 3.5 installer by putting system-wide installations into a directory (Program Files) that can only be modified by the administrative user.

There are three different categories for installations that Dower identified. He wondered which the Python project should be delivering. The first type of installation is the "as if bundled" by the operating system. That is really a Windows-only question because the other operating systems' installers already do this. An important consideration is that adding modules to this type of installation must be governed by having administrative privileges.

There is also the "just for me" case, where Python is installed only for one user. That is an important use case and for Python 3.5 it is supported by the installer. The downside is that those installations don't get security and other updates from the system administrator.

The final installation scenario is one that is private to an application. The result would not make Python available to anything other than the application that was installed. In addition, no changes to the modules available would be allowed except via the application's update process. There could be a ZIP file created as part of the Python build process that would be stored on python.org. Applications (e.g. the Mercurial version control system) could then bundle a particular version of Python. Thomas Wouters noted that this scenario is not Windows-specific, as applications for other operating systems might also want that ability.

No real conclusions came out of the session. It was more informational, seemingly, to update the developers present on the installer and Dower's thinking about it.