4 ms·

`pip freeze > requirements.txt`

• chatmasta 8y ago
  This assumes semantic versioning and does not actually pin dependencies to the hash of their bytes, like a lockfile does.
  • j88439h84 8y ago
    `pip-compile --generate-hashes` is the best way to manage python dependencies. https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools https://gist.github.com/hynek/5e85706cee589a204251b33359585392 https://gist.github.com/hynek/5e85706cee589a204251b333595853...
    • chatmasta 8y ago
      Could those hashes be different for the same package built on different architectures?
      • hynek 8y ago
        Yes, that’s why there’s multiple hashes per package.
  • LyndsySimon 8y ago
    This is another good point; one that's important to me, but that doesn't seem to resonate with others. Pipfile.lock ensures that the tarball I download for a given package release is exactly the same as the one I downloaded during development. This closes what I consider to be a fairly significant security hole.
• LyndsySimon 8y ago
  That's the way I did it before pipenv, but it has problems that I've outline elsewhere in this comment chain - chief amongst them, what happens when you want to remove a direct dependency? How do you identify its subdependencies and ensure they aren't being used by other dependencies as well?