News for hackers. Stuff that matters.

A comment on PSF Hires PyPI Safety and Security Engineer.

Re:PSF Hires PyPI Safety and Security Engineer by KRAKRISMOTT on Friday August 04, 2023 @02:22PM (#37003782)
My wishlist: a mirror metadata service like Yarn to force pypi to innovate more. Pip is slow because it doesn't store the dependency metadata and has to download all upstream dependencies during the resolution phase. They were too busy wasting time on minor issues like domain squatting than core dependency resolution concerns. I also want to see Python support simultaneously conflicting diamond dependencies like Npm and Cargo. Python doesn't even support shading. One old dependency and your whole build breaks, with no recourse aside from forking upstream.
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by thejcannon on Friday August 04, 2023 @02:46PM (#37004126)
Your first request is granted: https://peps.python.org/pep-0658/
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by bombolo on Friday August 04, 2023 @03:17PM (#37004545)
If your software requires 2 different versions of the same library, there is something deeply wrong with it.
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by fooker on Friday August 04, 2023 @03:24PM (#37004651)
It's fairly common in the compilers/tools world to have automated workflows to test against different tools and libraries.
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by bombolo on Saturday August 05, 2023 @01:19AM (#37009237)
And they are all needed at the same time?
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by fooker on Monday August 07, 2023 @06:13AM (#37032499)
Yes, you can't keep installing and uninstalling stuff to run tests.
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by KRAKRISMOTT on Friday August 04, 2023 @05:22PM (#37006073)
Most of the time diamond dependencies are upstream, not because the software itself requires two versions.
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by bombolo on Saturday August 05, 2023 @05:16AM (#37010343)
Yes, get better upstream.
[ Parent | on HN ]
Re:PSF Hires PyPI Safety and Security Engineer by mirashii on Saturday August 05, 2023 @12:59PM (#37014042)
> Pip is slow because it doesn't store the dependency metadata and has to download all upstream dependencies during the resolution phase.

This isn’t really true and hasn’t been for a long time. It relies on package authors to include the dependency metadata, but pypi has published it and pip has used it going back to at least 2017, if not earlier. They could do more to enforce it, but there’s a lot more to the story of why pip is slow than this.

[ Parent | on HN ]