3 ms·

FYI - You can overwrite an existing package’s release/version via pip (at least when using Artifactory’s PyPi). Not safe to assume pinning the version ‘freezes’

• nerdponx 5y ago
  Make a "lockfile" with the pip-compile tool [0] that includes hashes. Unless you happen to fetch the hash after the package has been compromised, this should keep you safe from an overwritten version. [0]: https://pypi.org/project/pip-tools/ https://pypi.org/project/pip-tools/
• oefrha 5y ago
  No, you cannot overwrite a file on PyPI once uploaded, even if you delete the release first. This policy has been in place for many years.
• globular-toast 5y ago
  Pip also supports packages hashes so you can be sure you're getting the exact same package that you got last time.