3 ms·
> I still don’t like that it’s possible to run arbitary commands on a user’s system just by them pip installing a package. Is there a build system out there th
by kortex 6y ago
> I still don’t like that it’s possible to run arbitary commands on a user’s system just by them pip installing a package.
Is there a build system out there that doesn't have this feature? Pip is both a package manager and build system since many packages are compiled at install time.
- pletnes 6y agoThe author refers to install time, not build time. I thought pip did not run code when installing .whl files? A —-wheels-only option would then be useful.
- x1798DE 6y agoYou are correct that installing a wheel doesn't execute arbitrary code. If you use `--only-binary :all:`, that is equivalent to --wheels-only. Though not all packages ship wheels