4 ms·
> npm verifies the SSL cert on its connection to the registry. pip does the same thing. Neither verifies signatures on the packages, or anything else. The top
by imagist 10y ago
> npm verifies the SSL cert on its connection to the registry. pip does the same thing. Neither verifies signatures on the packages, or anything else.
The top result from Google: https://pypi.python.org/security https://pypi.python.org/security
> Both of which are better than C build scripts that involve downloading tarballs from SourceForge and running `make install`.
True, but I thought you were the one who wanted to limit our conversation to competent installations?
> Sure. Babel didn't break when left-pad happened. A certain way of installing Babel did. I have no idea how you keep conflating a method of installing packages (that isn't even what serious production users use) with code. So, "all of them."
Really? So how do you install Babel the first time in order to shrinkwrap it?
> I can give you countless examples of mature libraries and software packages in C, Python, or many other languages where `./build.sh` or equivalent, that wgets some crap from SourceForge, stopped working in the same way.
Okay, give me countless examples.
- geofft 10y ago> The top result from Google: https://pypi.python.org/security https://pypi.python.org/security I'm not sure what this has to do with anything. Yes, you may sign your uploads. Nobody verifies them on download. Since you seem to be a fan of Google, try Googling 'pip signature verification' and reading the results. Here's one place to start: https://github.com/pypa/twine/issues/157 https://github.com/pypa/twine/issues/157 > Really? So how do you install Babel the first time in order to shrinkwrap it? The same way you install anything else from any other ecosystem? The packages have to be up and online when you initially retrieve them, yes. I have no idea how you think that's NPM-specific. If you would like to download some code, you have to have somewhere to download it from.