3 ms·
Thank you for writing this. It helped me relate a lot of half-thoughts around coordinated releases, and lack of connection between build artifacts and code (see
by nighthawk454 5y ago
Thank you for writing this. It helped me relate a lot of half-thoughts around coordinated releases, and lack of connection between build artifacts and code (see: PyPI…).
There is a certain strangeness that we have a very distributed and local notion of code, but _running_ that code (even in local environments) is much harder.
- pabs3 5y agoPyPI really needs reproducible builds and bootstrappable builds. https://reproducible-builds.org/ https://reproducible-builds.org/ https://bootstrappable.org/ https://bootstrappable.org/
- nighthawk454 5y agoBadly. Best I can tell, you can't even get the source for a certain build. Even if the owners bother to put a tag in git, there's no proof that's the code they used or even necessarily how they built it. Everything on PyPI is just random artifacts uploaded by whoever ran a build script on their machine - it's nuts.