Use zip instead of tar.gz to obtain setuptools

[krinnewitz]

Newer releases of setuptools on pypi are only available as zip archives.

In order to support higher versions of setuptools, zip should be
preferred over tar.gz. Otherwise, installing e.g. setuptools==40.0.0
will fail.

[AndreMiras]

Demonstrating the 404 on tar.gz:

$ curl --location --head https://pypi.python.org/packages/source/s/setuptools/setuptools-40.0.0.tar.gz
HTTP/2 301 
server: Varnish
retry-after: 0
location: https://pypi.org/packages/source/s/setuptools/setuptools-40.0.0.tar.gz
content-type: text/html; charset=UTF-8
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:20 GMT
x-served-by: cache-mad9427-MAD
x-cache: HIT
x-cache-hits: 0
x-timer: S1534861161.521854,VS0,VE0
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 122

HTTP/2 301 
content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
content-type: text/html; charset=UTF-8
location: https://files.pythonhosted.org/packages/source/s/setuptools/setuptools-40.0.0.tar.gz
referrer-policy: origin-when-cross-origin
server: nginx/1.13.9
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:20 GMT
age: 35
x-served-by: cache-iad2128-IAD, cache-cdg20750-CDG
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-timer: S1534861161.634091,VS0,VE0
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 281

HTTP/2 404 
content-type: application/octet-stream
server: nginx/1.13.9
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:20 GMT
age: 117
x-served-by: cache-iad2136-IAD, cache-mad9444-MAD
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-timer: S1534861161.760755,VS0,VE0
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-robots-header: noindex
content-length: 0

Demo the zip is working however:

$ curl --location --head https://pypi.python.org/packages/source/s/setuptools/setuptools-40.0.0.zip
HTTP/2 301 
server: Varnish
retry-after: 0
location: https://pypi.org/packages/source/s/setuptools/setuptools-40.0.0.zip
content-type: text/html; charset=UTF-8
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:44 GMT
x-served-by: cache-mad9434-MAD
x-cache: HIT
x-cache-hits: 0
x-timer: S1534861185.702466,VS0,VE0
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 122

HTTP/2 301 
content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
content-type: text/html; charset=UTF-8
location: https://files.pythonhosted.org/packages/source/s/setuptools/setuptools-40.0.0.zip
referrer-policy: origin-when-cross-origin
server: nginx/1.13.9
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:44 GMT
age: 31
x-served-by: cache-iad2138-IAD, cache-cdg20728-CDG
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-timer: S1534861185.826366,VS0,VE0
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 278

HTTP/2 302 
cache-control: max-age=604800, public
content-type: application/octet-stream
location: https://files.pythonhosted.org/packages/d3/3e/1d74cdcb393b68ab9ee18d78c11ae6df8447099f55fe86ee842f9c5b166c/setuptools-40.0.0.zip
server: nginx/1.13.9
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:45 GMT
age: 31815
x-served-by: cache-iad2149-IAD, cache-mad9434-MAD
x-cache: HIT, HIT
x-cache-hits: 1, 1
x-timer: S1534861185.999524,VS0,VE1
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-robots-header: noindex
content-length: 0

HTTP/2 200 
x-amz-id-2: ZI6sVzELKbLuAkh8VV7989ObJg98a6JltZ9i5NbZcUJ9p0xxz3GP+oZF79ukL5oQvqv7VCxo9D0=
x-amz-request-id: 566ECB66DDCC623F
last-modified: Mon, 09 Jul 2018 04:23:06 GMT
etag: "260630ae1a64bafa39dcc53404d63829"
x-amz-version-id: .FhqRjfhAVedk2IvSuQSmHMZEVTZY3tw
content-type: binary/octet-stream
server: AmazonS3
cache-control: max-age=365000000, immutable, public
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:19:45 GMT
age: 3750980
x-served-by: cache-sea1029-SEA, cache-mad9434-MAD
x-cache: HIT, HIT
x-cache-hits: 1, 1
x-timer: S1534861185.025460,VS0,VE2
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-robots-header: noindex
content-length: 849857

Demo that it doesn't introduce regression with the current default version 18.3.1:

$ curl --location --head https://pypi.python.org/packages/source/s/setuptools/setuptools-18.3.1.zip
HTTP/2 301 
server: Varnish
retry-after: 0
location: https://pypi.org/packages/source/s/setuptools/setuptools-18.3.1.zip
content-type: text/html; charset=UTF-8
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:20:35 GMT
x-served-by: cache-mad9426-MAD
x-cache: HIT
x-cache-hits: 0
x-timer: S1534861236.783058,VS0,VE0
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 122

HTTP/2 301 
content-security-policy: base-uri 'self'; block-all-mixed-content; connect-src 'self' https://api.github.com/repos/ *.fastly-insights.com sentry.io https://2p66nmmycsj3.statuspage.io; default-src 'none'; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' https://warehouse-camo.cmh1.psfhosted.org/ www.google-analytics.com *.fastly-insights.com; script-src 'self' www.googletagmanager.com www.google-analytics.com *.fastly-insights.com https://cdn.ravenjs.com; style-src 'self' fonts.googleapis.com; worker-src *.fastly-insights.com
content-type: text/html; charset=UTF-8
location: https://files.pythonhosted.org/packages/source/s/setuptools/setuptools-18.3.1.zip
referrer-policy: origin-when-cross-origin
server: nginx/1.13.9
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:20:36 GMT
age: 0
x-served-by: cache-iad2135-IAD, cache-cdg20737-CDG
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1534861236.909439,VS0,VE100
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
content-length: 278

HTTP/2 302 
cache-control: max-age=604800, public
content-type: application/octet-stream
location: https://files.pythonhosted.org/packages/22/26/6fdaea27dbe43163d63871f31cfce9a928520f616c1cbb5c98f2a37920a6/setuptools-18.3.1.zip
server: nginx/1.13.9
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:20:36 GMT
age: 179146
x-served-by: cache-iad2130-IAD, cache-mad9426-MAD
x-cache: HIT, HIT
x-cache-hits: 1, 1
x-timer: S1534861236.130085,VS0,VE0
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-robots-header: noindex
content-length: 0

HTTP/2 200 
x-amz-id-2: CNQRErVk28QyhM6SRE6pk8FImwqa3GA1HMQ0ALbmCJrBdXEWYH5EH/i+3pEy53L95Hg2cfGWgBY=
x-amz-request-id: DF5989E89A2E1EF0
last-modified: Wed, 20 Apr 2016 10:59:36 GMT
etag: "c3b735ed07bd38e3145c165ac27b311f"
x-amz-version-id: ISDqBXDn1.QaPFLw6MfLtRTxNKuzezji
content-type: application/octet-stream
server: AmazonS3
cache-control: max-age=365000000, immutable, public
accept-ranges: bytes
date: Tue, 21 Aug 2018 14:20:36 GMT
age: 53466
x-served-by: cache-sea1025-SEA, cache-mad9426-MAD
x-cache: HIT, HIT
x-cache-hits: 1, 1
x-timer: S1534861236.155079,VS0,VE54
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: deny
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-robots-header: noindex
content-length: 670643