5 ms·

This assumes semantic versioning and does not actually pin dependencies to the hash of their bytes, like a lockfile does.

• j88439h84 8y ago
  `pip-compile --generate-hashes` is the best way to manage python dependencies. https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools https://gist.github.com/hynek/5e85706cee589a204251b33359585392 https://gist.github.com/hynek/5e85706cee589a204251b333595853...
  • chatmasta 8y ago
    Could those hashes be different for the same package built on different architectures?
    • hynek 8y ago
      Yes, that’s why there’s multiple hashes per package.
• LyndsySimon 8y ago
  This is another good point; one that's important to me, but that doesn't seem to resonate with others. Pipfile.lock ensures that the tarball I download for a given package release is exactly the same as the one I downloaded during development. This closes what I consider to be a fairly significant security hole.