undefined | Better HN

0 pointsmardifoufs1y ago0 comments

Well, for one you can't actually package or add a local requirement (for example , a vendored package) to the usual pip requirements.txt (or with pyproject.toml, or any other standard way) afaik.

I saw a discourse reply that cited some sort of possible security issue but that was basically it and that means that the only way to get that functionality is to not use pip. It's really not a lot of major stuff, just a lot of little paper cuts that makes it a lot easier to just use something else once your project gets to a certain size.

0 comments

BeefWellington1y ago

Sure you can.

It's in their example for how to use requirements.txt: https://pip.pypa.io/en/stable/reference/requirements-file-fo...

Maybe there's some concrete example you have in mind though?

mardifoufsOP1y ago

I don't think so, though maybe I didn't explain myself correctly. You can link to a relative package wheel I think, but not to a package repo. So if you have a repo, with your main package in ./src, and you vendor or need a package from another subfolder (let's say ./vendored/freetype) , you can't actually do it in a way that won't break the moment you share your package. You can't put ./vendored/freetype in your requirements.txt, it just fails.

That means you either need to use pypi or do an extremely messy hack that involves adding the vendored package as a sub package to your main source, and then do some importlib black magic to make sure that everything uses said package.

https://github.com/pypa/pip/issues/6658

https://discuss.python.org/t/what-is-the-correct-interpretat...

BeefWellington1y ago

In this scenario, reading between the lines, the vendor is not providing a public / published package but does provide the source as like a tarball?

I have yet to run into that particular case where the vendor didn't supply their own repo in favour of just providing the source directly. However I do use what are essentially vendor-supplied packages (distant teams in the org) and in those cases I just point at their GitLab/GitHub repo directly. Even for some components within my own team we do it this way.

1 more reply

j / k navigate · click thread line to collapse

0 pointsmardifoufs1y ago0 comments

Well, for one you can't actually package or add a local requirement (for example , a vendored package) to the usual pip requirements.txt (or with pyproject.toml, or any other standard way) afaik.

0 comments

BeefWellington1y ago

Sure you can.

It's in their example for how to use requirements.txt: https://pip.pypa.io/en/stable/reference/requirements-file-fo...

Maybe there's some concrete example you have in mind though?

mardifoufsOP1y ago

https://github.com/pypa/pip/issues/6658

https://discuss.python.org/t/what-is-the-correct-interpretat...

BeefWellington1y ago

In this scenario, reading between the lines, the vendor is not providing a public / published package but does provide the source as like a tarball?

1 more reply

j / k navigate · click thread line to collapse