News for hackers. Stuff that matters.
Re:Pypi.org is running a survey on the state of Python packa... by mdmglr on Wednesday September 07, 2022 @12:42PM (#32752941)
My wishlist:

We need a way to configure an ordered list of indexes pip searches for packages. —extra-index-url or using a proxy index is not the solution.

Also namespaces and not based on a domain. So for example: pip install apache:parquet

Also some logic either in the pip client or index server to minimize typosquatting

Also pip should adopt a lock file similar to npm/yarn. Instead of requirements.txt

And also “pip list” should output a dependency tree like “npm list”

I should not have to compile source when I install. Every package should have wheels available for the most common arch+OS combos.

Also we need a way to download only what you need. Why does installing scipy or numpy install more dependencies than the conda version? For example pywin and scipy.

Re:Pypi.org is running a survey on the state of Python packa... by tempest_ on Wednesday September 07, 2022 @03:42PM (#32755658)
If you are using poetry you can add something to the pyproject.toml to handle the indexes, though I am not sure if they are ordered or not

[[tool.poetry.source]] name = "my-pypi" url = "https://my-pypi-index.wherever" secondary = true

Re:Pypi.org is running a survey on the state of Python packa... by mdmglr on Thursday September 08, 2022 @06:23PM (#32772829)
Thanks. I’ll look into this.
Re:Pypi.org is running a survey on the state of Python packa... by jbylund on Thursday September 08, 2022 @08:23AM (#32764466)
Typosquatting is a thing that has been looked at and is being looked at:

https://github.com/pypi/warehouse/pull/5001 - had to be reverted because it was too noisy

https://github.com/pypi/warehouse/issues/9527

Re:Pypi.org is running a survey on the state of Python packa... by ciupicri on Wednesday September 07, 2022 @04:21PM (#32756236)
> apache:parquet

How are you going to name the file storing the wheel for that package? Using ":" on Windows is going to be problematic.

Re:Pypi.org is running a survey on the state of Python packa... by mdmglr on Thursday September 08, 2022 @06:23PM (#32772824)
That’s right. Then some other delimiter.