6 ms·
This is great, and a definite step up from the current requirements.txt. Why are the requirements like function calls though? Why can't they just keep a simple
by yladiz 10y ago
This is great, and a definite step up from the current requirements.txt. Why are the requirements like function calls though? Why can't they just keep a simple text format that's more human readable and editable, rather than something that just looks like a bunch of code? I think it's better in Ruby because you can omit parentheses and it looks cleaner, but my preference above both is package.json. Cargo is also really good. So in my eyes, moving to something like this is somewhat of a step backwards from requirements.txt, but taken together it looks like it will be better overall.
There are arguments for and against, but in general I think a configuration file should be human readable and editable, as well as easily understood by an IDE without having to run an interpreter. So something like YAML or TOML, or even a simple INI would be better than the function calls in the Pipfile. However, the lock file isn't meant to be edited by hand or really ever looked at, so it being in JSON or something less human readable is fine.
Also, why doesn't pip just make it, by default, look for the requirements.txt or the Pipfile? It's silly having to type pip install -r requirements.txt and I will also find it silly having to type pip -p. It's how NPM, Bundler, and many other package managers work; why do I need to call a flag to install requirements?
- scarygliders 10y ago> why do I need to call a flag to install requirements? Because pip is used extensively as a manual command to install something - you don't expect something like DIR or ls to automatically get its list of files to list from a DIR.txt or a ls.txt file, do you?
- yladiz 10y agoCan you call pip install by itself?
- fredsir 10y agoNo, and I think it would be great to be able to just call `pip install` and have it use the pipfile if available.
- scarygliders 10y agoI disagree - explicit is better than implicit. What if one intended to type "pip install pillow" but got as far as "pip install " and unintentionally hit <Return> ? Oh but there's a requirements.txt file sitting right there and "awwww heck now pip is reading it in and installing everything in there.. all I wanted was this new package not listed in that requirements.txt file..."
- Senji 10y agoJust have an env var that's off by default. Name it $piparanoia
- yladiz 10y agoSure that happens, but is it worth the hassle of having to type -p or -r requirements.txt every time you want to install the requirements for your project? Following that dogma without regard for the reality of what actually works better is silly. It's not always the case that doing what everyone else does is good, but it seems the consensus is have sensible defaults. This is a similar argument to what happened when Babel in JS land decided to not have anything happen by default and explicitly require you to decide your configuration. It's silly to force users to do something that could be solved by a sensible default, and this is a clear case where a sensible default is appropriate.
- marcosdumay 10y agoIs it so much trouble? How often do you type 'pip install -r requirements.txt' outside of a script? Personally, I'm in the "whatever" camp. But you can be certain that such a change will break something.
- lukeschlather 10y agoFor me it's more about encouraging good behavior. While it's common to pip install random packages, that should really be the exception rather than the rule. Usually you should make a project, add some packages, and run `pip install`. Right now, the whole system encourages you to build bespoke environments that are really difficult to replicate. Making the default use requirements.txt encourages you to write down everything you're doing in a reproducible way.
- amelius 10y ago> Why are the requirements like function calls though? Flexibility?
- scrollaway 10y agoYou lose flexibility if you can't parse or modify the file with a known parser (TOML, JSON)
- amelius 10y agoYou should parse the file by running it.
- scrollaway 10y agoI'd expect any developer worth their salt to know why that's a bad idea - or are we still parsing json using eval()?
- piqufoh 10y agoThat sounds like a terrible idea - especially if you don't know if you can trust the source of the file.
- dismantlethesun 10y agoInstallation files by default are run. If you have a normal Python module sitting on PyPi, and install it it may run a setup.py which could potentially do anything that your currently active user is allowed to do. Adding custom programming logic into the requirements' file isn't really an issue, when setup.py could already grab a C compiler and start binding in system libraries into its package.
- scrollaway 10y agoYou're missing the forest for the trees. My point was that you're losing flexibility when you're not able to parse/generate a data-driven file using a well-known data format. And unless you're using a homoiconic format, code is not (easily) parsable as data.
- antihero 10y agoWell ls without arguments lists the most relevant thing, ie the files in the current directly. So it would follow that tools do their thing based on the current directory, as specified by package.json/Makefile/Gulpfile/Dockerfile/Vagrantfile et all.
- techdragon 10y ago"Explicit is better than implicit" - The Zen of Python
- bjt 10y agoThe function calls in the Pipfile make me suspect it's going to be read and eval-ed within Python. And that makes me shudder. Many packages have abused the executable nature of setup.py files by importing obscure packages or adding otherwise fragile logic. I would hate to see Pipfiles go the same way. Strong +1 to making it a declarative format like YAML or TOML instead of something executable.
- xapata 10y ago> eval ... makes me shudder Why do you prefer using ``pip`` despite ``pip install`` using the package's ``setup.py`` (and therefore is an eval)? Further, if you're using a package manager, I expect you won't be combing through the source to check for malicious code anyway.
- quodlibetor 10y agoFor the non-install case, like when you're running a package index, having to eval the dependency specifying is horrible. This is also why wheels (the new python package format) use a static file instead of setup.py. The Python ecosystem has been trying to get off of "just eval setup.py" for years.
- xapata 10y agoI'm not sure why avoiding arbitrary code execution during install is important when you're going to do arbitrary code execution shortly after. What else is the purpose of installing a package?
- tim333 10y agoI rather like it looking like code on the other hand. I assume it actually is code so you could write if soandso: package("pack1") else: ... ?
- theptip 10y agoWhen do you need to do such conditional installing? (Aside from the `if dev: install dev-dependencies`, which is special-cased in npm and this proposal too). Py2/3 compatibility? I've never had to do this, interested what the use-case is.
- detaro 10y agoIt might be useful for dependencies that are only available and/or required on some platform?
- yladiz 10y agoGithub and Discourse did some conditional installation stuff when dealing with different versions of Rails. I don't remember the specifics of Discourse, but the Github one was due to their change from Rails 2.3 to Rails 3 and the different packages they needed to include in 2.3. This case is pretty minimal though and I haven't heard of many (any?) cases outside of those two.