5 ms·
I've used virtualenv, pipenv, pyenv, venv, etc. What the hell is the difference? All that I have used have worked pretty much exactly the same as the others. A
by Apreche 8y ago
I've used virtualenv, pipenv, pyenv, venv, etc.
What the hell is the difference? All that I have used have worked pretty much exactly the same as the others. All work just fine. I've never had a problem. I just use virtualenv since it's the oldest. I see no more reason to switch or try other options as long as it continues to deliver.
- sjburt 8y agoYeah, the problems with python packaging can not be fixed by any tool. There is simply no way to determine the dependencies of a python package without downloading it and all its dependencies. And, no accurate way without actually interpreting setup.py.
- pmoriarty 8y ago"What the hell is the difference?" One of the big selling points of pipenv is that you can pin the versions of the packages you use and their dependencies. None of the others do this, afaik.
- bitfhacker 8y agoWith pip you can: pip install package==version
- coleifer 8y ago`pip freeze > requirements.txt`
- chatmasta 8y agoThis assumes semantic versioning and does not actually pin dependencies to the hash of their bytes, like a lockfile does.
- j88439h84 8y ago`pip-compile --generate-hashes` is the best way to manage python dependencies. https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools https://gist.github.com/hynek/5e85706cee589a204251b33359585392 https://gist.github.com/hynek/5e85706cee589a204251b333595853...
- LyndsySimon 8y agoThis is another good point; one that's important to me, but that doesn't seem to resonate with others. Pipfile.lock ensures that the tarball I download for a given package release is exactly the same as the one I downloaded during development. This closes what I consider to be a fairly significant security hole.
- LyndsySimon 8y agoThat's the way I did it before pipenv, but it has problems that I've outline elsewhere in this comment chain - chief amongst them, what happens when you want to remove a direct dependency? How do you identify its subdependencies and ensure they aren't being used by other dependencies as well?
- adaszko 8y agoWith pip for instance, it often happens that a transitive dependency gets updated inadvertently breaking your code. This follows from the assumption that all packages follow semantic versioning perfectly and keep backward compatibility where they should. This is not the case in practice and experience has shown it is unrealistic to have that assumption. A better way is to rely on exact versions of packages (up to a single bit) and not on semantic versioning.
- icebraining 8y agoHow would you updated something inadvertently?
- EdwardDiego 8y agoTransitive dependencies... it seems to be common in Python libs to express dependencies using version ranges - but then version 18.1 breaks something that worked under 18.0 - which isn't what you'd expect if it followed semver.
- LyndsySimon 8y agoIf the specific version of a dependency (or subdependency) isn't pinned, then the next time the package is installed in another environment it'll get the most recent matching version. That version might break your code. If the specific version of all subdependencies are pinned, then you have a mess on your hands of keeping track of what's actually required. You have to either manually maintain your requirements.txt, or you run the risk of removing a dependency and missing the removal of its subdependencies. Further, you can't just upgrade everything, but dependencies might have conflicting version requirements for subdependencies.
- openbasic 8y agoHave you ever used any other mature dependency management tool? Leiningen, Cargo, Composer, Yarn, just to name a few. All of them are light-years ahead of anything Python provides, which is sad.
- gizmo385 8y ago+1 The capabilities provided by a tool like Leiningen[1] just makes everything even tangentially related to dependency management an absolute breeze.