Re:Pypi.org is running a survey on the state of Python packa...
by tempest_ on Wednesday September 07, 2022 @03:42PM
(#32755658)
If you are using poetry you can add something to the pyproject.toml to handle the indexes, though I am not sure if they are ordered or not
[[tool.poetry.source]] name = "my-pypi" url = "https://my-pypi-index.wherever" secondary = true
Re:Pypi.org is running a survey on the state of Python packa...
by mdmglr on Thursday September 08, 2022 @06:23PM
(#32772829)
Thanks. I’ll look into this.
Re:Pypi.org is running a survey on the state of Python packa...
by jbylund on Thursday September 08, 2022 @08:23AM
(#32764466)
Typosquatting is a thing that has been looked at and is being looked at:
https://github.com/pypi/warehouse/pull/5001 - had to be reverted because it was too noisy
We need a way to configure an ordered list of indexes pip searches for packages. —extra-index-url or using a proxy index is not the solution.
Also namespaces and not based on a domain. So for example: pip install apache:parquet
Also some logic either in the pip client or index server to minimize typosquatting
Also pip should adopt a lock file similar to npm/yarn. Instead of requirements.txt
And also “pip list” should output a dependency tree like “npm list”
I should not have to compile source when I install. Every package should have wheels available for the most common arch+OS combos.
Also we need a way to download only what you need. Why does installing scipy or numpy install more dependencies than the conda version? For example pywin and scipy.