Feature Change:

Added a configuration option that causes buildout to error if a
  version is picked. This is a nice safety belt when fixing all
  versions is intented, especially whan creating releases.

(This already-desired feature made it easier to write the test for
  the bug fix below. :)

Bug Fixed:

When installing from source releases, a version specification (via a
  buildout versions section) for setuptools was ignored when deciding
  which setuptools to use to build an egg from the source release.

CHANGES.txt

@@ -30,6 +30,10 @@ Feature Changes
   By default use-dependency-links is true, which matches the behavior
   of previous versions of buildout.
 
+- Added a configuration option that causes buildout to error if a
+  version is picked. This is a nice safety belt when fixing all
+  versions is intented, especially whan creating releases.
+
 Bugs Fixed
 ----------
 
@@ -49,6 +53,10 @@ Bugs Fixed
 - When using a local find links or index, distributions weren't copied
   to the download cache.
 
+- When installing from source releases, a version specification (via a
+  buildout versions section) for setuptools was ignored when deciding
+  which setuptools to use to build an egg from the source release.
+
 1.0.0b30 (2007-08-20)
 =====================
 

src/zc/buildout/buildout.py

@@ -170,6 +170,13 @@ class Buildout(UserDict.DictMixin):
         zc.buildout.easy_install.use_dependency_links(
             use_dependency_links == 'true')
 
+        allow_picked_versions = options.get('allow-picked-versions', 'true')
+        if allow_picked_versions not in ('true', 'false'):
+            self._error('Invalid value for allow-picked-versions option: %s',
+                        allow_picked_versions)
+        zc.buildout.easy_install.allow_picked_versions(
+            allow_picked_versions=='true')
+
         download_cache = options.get('download-cache')
         if download_cache:
             download_cache = os.path.join(options['directory'], download_cache)

src/zc/buildout/easy_install.py

@@ -116,6 +116,7 @@ class Installer:
     _install_from_cache = False
     _prefer_final = True
     _use_dependency_links = True
+    _allow_picked_versions = True
     
     def __init__(self,
                  dest=None,
@@ -262,7 +263,8 @@ class Installer:
         tmp = tempfile.mkdtemp(dir=dest)
         try:
             path = self._get_dist(
-                pkg_resources.Requirement.parse('setuptools'), ws, False,
+                self._constrain(pkg_resources.Requirement.parse('setuptools')),
+                ws, False,
                 )[0].location
 
             args = ('-c', _easy_install_cmd, '-mUNxd', _safe_arg(tmp))
@@ -529,6 +531,10 @@ class Installer:
                 ):
                 logger.debug('Picked: %s = %s',
                              dist.project_name, dist.version)
+                if not self._allow_picked_versions:
+                    raise zc.buildout.UserError(
+                        'Picked: %s = %s' % (dist.project_name, dist.version)
+                        )
 
         return dists
 
@@ -717,6 +723,12 @@ def use_dependency_links(setting=None):
         Installer._use_dependency_links = bool(setting)
     return old
 
+def allow_picked_versions(setting=None):
+    old = Installer._allow_picked_versions
+    if setting is not None:
+        Installer._allow_picked_versions = bool(setting)
+    return old
+
 def install(specs, dest,
             links=(), index=None,
             executable=sys.executable, always_unzip=False,

src/zc/buildout/easy_install.txt

@@ -300,6 +300,23 @@ reporting that a version was picked automatically:
     >>> handler.uninstall()
     >>> logging.getLogger('zc.buildout.easy_install').propagate = True
 
+We can request that we get an error if versions are picked:
+
+    >>> zc.buildout.easy_install.allow_picked_versions(False)
+    True
+
+(The old setting is returned.)
+
+    >>> ws = zc.buildout.easy_install.install(
+    ...     ['demo'], dest, links=[link_server], index=link_server+'index/',
+    ...     )
+    Traceback (most recent call last):
+    ...
+    UserError: Picked: demo = 0.3
+
+    >>> zc.buildout.easy_install.allow_picked_versions(True)
+    False
+
 The function default_versions can be used to get and set default
 version information to be used when no version information is passes.
 If called with an argument, it sets the default versions:

src/zc/buildout/repeatable.txt

@@ -160,3 +160,21 @@ We won't get output for the spam distribution, which we didn't pick,
 but we will get output for setuptools, which we didn't specify
 versions for.
 
+You can request buildout to generate an error if it picks any
+versions:
+
+    >>> write('buildout.cfg',
+    ... '''
+    ... [buildout]
+    ... parts = foo
+    ... find-links = %s
+    ... versions = release-1
+    ... allow-picked-versions = false
+    ...
+    ... [release-1]
+    ... spam = 1
+    ... eggs = 2.2
+    ...
+    ... [foo]
+    ... recipe = spam
+    ... ''' % join('recipe', 'dist'))

src/zc/buildout/tests.py

@@ -2360,6 +2360,44 @@ Distribution setup scripts can import modules in the distribution directory:
 
     """
 
+def dont_pick_setuptools_if_version_is_specified_when_required_by_src_dist():
+    """
+When installing a source distribution, we got setuptools without
+honoring our version specification.
+
+    >>> mkdir('dist')
+    >>> write('setup.py',
+    ... '''
+    ... from setuptools import setup
+    ... setup(name='foo', version='1', py_modules=['foo'], zip_safe=True)
+    ... ''')
+    >>> write('foo.py', '')
+    >>> _ = system(buildout+' setup . sdist')
+
+    >>> write('buildout.cfg',
+    ... '''
+    ... [buildout]
+    ... parts = foo
+    ... find-links = dist
+    ... versions = versions
+    ... allow-picked-versions = false
+    ...
+    ... [versions]
+    ... setuptools = %s
+    ... foo = 1
+    ...
+    ... [foo]
+    ... recipe = zc.recipe.egg
+    ... eggs = foo
+    ... ''' % pkg_resources.working_set.find(
+    ...    pkg_resources.Requirement.parse('setuptools')).version)
+
+    >>> print system(buildout),
+    Installing foo.
+    Getting distribution for 'foo==1'.
+    Got foo 1.
+    
+    """
 
 ######################################################################