PasteDeploy

Warnings

• gotcha Using `eval()` directly in PasteDeploy configuration files (`.ini`) can pose a security risk. If an untrusted user can modify the configuration file, they could inject and execute arbitrary Python code.
  Fix: Avoid `eval()` for dynamic configuration values if the configuration source is untrusted. Prefer explicit environment variable lookups or secure configuration management systems. If `eval()` is necessary, ensure the configuration file's integrity and source are highly trusted.
• gotcha The `global_conf` dictionary passed to app factories is typically a shallow copy or reference to the entire configuration. Modifying `global_conf` within an app factory or middleware can lead to unexpected side effects, especially if the same `global_conf` object is reused across multiple components.
  Fix: Treat `global_conf` as read-only. If a component needs to store or modify its own state, use `local_conf` or instance attributes. Avoid passing sensitive information directly in `global_conf` from a file; prefer environment variables or secure vault integrations, potentially accessed within the app factory.
• breaking Versions of PasteDeploy prior to 2.0.0 supported Python 2. Versions 2.0.0 and later are Python 3-only. Migrating from older projects will require significant code changes for Python 3 compatibility, beyond just updating PasteDeploy itself.
  Fix: Upgrade your entire project to Python 3. Ensure all dependencies are Python 3 compatible. Review `pastedeploy`'s changelog for `2.0.0` and subsequent versions for specific API changes related to Python 3. The `pastedeploy` package itself requires Python 3.7+ as of version 3.x.
• gotcha PasteDeploy configuration for application factories can use `egg:package_name#entry_point` or `call:module_name:factory_function`. Developers often confuse these, especially how `egg:` relies on `setuptools` entry points vs. `call:` which requires the module to be importable and the factory function directly discoverable.
  Fix: Understand the difference: `egg:` is for applications installed as Python packages that register `setuptools` entry points (e.g., `pastedeploy.app_factory` entry points). `call:` is for directly importing a function or callable from a module path. For local development or simple scripts, `call:` is often easier to use directly with a Python file, while `egg:` is common for reusable middleware or frameworks.

Install

• pip install pastedeploy Install stable release

Imports

• loadapp

  from paste.deploy import loadapp

  PasteDeploy's main functions are typically imported directly from the `paste.deploy` namespace, not as submodules of `pastedeploy`.
• loadserver

  from paste.deploy import loadserver

• loadfilter

  from paste.deploy import loadfilter

• appconfig

  from paste.deploy import appconfig

Quickstart

This quickstart demonstrates how to define a WSGI application factory, configure it in an `INI` file, and load it using `paste.deploy.loadapp`. It also shows how to pass `global_conf` values and use `eval()` to pull environment variables into the configuration, which is a common pattern for sensitive values (though with security caveats as noted in warnings). Running this code will create a temporary `config.ini`, load a dummy WSGI app, print its configuration, and then clean up.

import os
import sys
from io import StringIO
from paste.deploy import loadapp

# --- 1. Create a dummy config.ini for demonstration ---
# This config uses 'call:__main__:create_app' to reference an app factory
# defined directly in this script. It also shows `eval` for env vars.
config_content = """
[app:main]
use = call:__main__:create_app
some_setting = hello
another_setting = world
my_env_var = eval(os.environ.get('QUICKSTART_ENV_VAR', 'default_env_val'))

[server:main]
use = egg:waitress#main  # Waitress is a common WSGI server
host = 127.0.0.1
port = 8080
"""

with open("config.ini", "w") as f:
    f.write(config_content)

# --- 2. Define the WSGI application factory ---
# This factory function will be called by PasteDeploy to create the app.
# It receives `global_conf` and other settings from the INI file.
def create_app(global_conf, some_setting, another_setting, my_env_var):
    # Using wsgiref.simple_server.demo_app as a placeholder WSGI app
    from wsgiref.simple_server import demo_app
    print(f"[create_app] App factory called with global_conf: {global_conf}")
    print(f"[create_app]   some_setting: {some_setting}")
    print(f"[create_app]   another_setting: {another_setting}")
    print(f"[create_app]   my_env_var (from os.environ via eval): {my_env_var}")
    return demo_app

# --- 3. Load the application using paste.deploy ---
print("\n--- Attempting to load WSGI application from config.ini ---")

# Set an environment variable for testing `eval` in the config.
os.environ['QUICKSTART_ENV_VAR'] = 'set_from_env_value'

# `global_conf` is passed to the app factory (read-only configuration).
# The '#main' refers to the `[app:main]` section in config.ini.
try:
    app = loadapp('config:config.ini#main', global_conf={'process_id': os.getpid(), 'api_key': os.environ.get('PASTEDEPLOY_API_KEY', '')})
    print(f"Successfully loaded WSGI application: {app}")

    # Verify the loaded app is callable (a basic WSGI check)
    assert callable(app)
    # A minimal test of the WSGI app (not actually running a server)
    response_body = []
    def start_response(status, headers):
        pass
    list(app({'REQUEST_METHOD': 'GET', 'PATH_INFO': '/'}, start_response))
    print("WSGI app is callable and passes a basic test.")

finally:
    # --- 4. Clean up (important for a self-contained quickstart) ---
    os.remove("config.ini")
    if 'QUICKSTART_ENV_VAR' in os.environ:
        del os.environ['QUICKSTART_ENV_VAR']
    print("\n--- Cleanup: Removed config.ini and environment variable ---")