Feynmanix

6 ms·

1.
by Feynmanix 1y ago
As long as they run `pip install` locally at any point in their process before pushing to the repo, they should get the opportunity to see the pipask report.
2.
by Feynmanix 1y ago
Have a look at the diagram in the accompanying blog post https://medium.com/data-science-collective/pipask-know-what-... , it explains how the process works. In short, you can get metadata from pyproject.toml, but (a)
3.
by Feynmanix 1y ago
But before committing requirements.txt to git, they still run install locally, right?
4.
by Feynmanix 1y ago
Thanks, I'll have a look, possibly add a link to it
5.
by Feynmanix 1y ago
I'll have a look at that
6.
by Feynmanix 1y ago
Yes, I can! Will be in the next release
7.
by Feynmanix 1y ago
Do you have a link where I can learn more about PAPER?
8.
by Feynmanix 1y ago
It's not visible on the screenshot for some reason, but if you run the latest version, you'll notice a little underline under the CVE mention. It's actually a hyperlink (Cmd+click in iTerm2) that leads to https://o
9.
by Feynmanix 1y ago
Yes, the reason I had to fork pip was that the dependency resolution logic is too complex and I couldn't recreate it from scratch with fidelity. You're right I don't vendor dependencies, and I hope to get away with it exactly
10.
by Feynmanix 1y ago
Ideally, you should use lockfiles for your CI/CD or docker. To create or update the lockfile, a developer needs to install dependencies manually first (as in `pip install X` -> `pip freeze`), at which point the checks would be execu
11.
by Feynmanix 1y ago
Thanks! Good question. I think the main downsides are: - installation takes a few more seconds to do the checks - you need to trust me, a random person from the internet - if there are any subtle differences between pip versions, the check
12.
by Feynmanix 1y ago
Great point! If you alias pip to pipask in your .*rc file, than this should already work out of the box for some tools, but there may be problems such as the need for non-interactive flows and configuring failure thresholds. I'll think
13.
by Feynmanix 1y ago
Perhaps it's not clear from my description above, but I'm afraid the flaw is in the Python package ecosystem itself rather than pip. I'm not very familiar with uv, but from what I can tell from the documentation, it needs to
14.
Show HN: Pipask – safer pip without compromising convenience(github.com)
52 points by Feynmanix 1y ago|38 comments