5 ms·

Freezing Requirements with Pip-Tools

55 points by BerislavLopac 4y ago

Rainymood 4y ago
Did you ever try poetry[1]? It is a great tool that I use in all my projects. It effectively solves dependency management for me in a very easy to use way. Dependency management using requirements.txt used to give me such a headache, now I just have a pyproject.toml that I know works. [tool.poetry.dependencies] python = ">=3.8,<3.9" pandas = "^1.4.3" This basically means: Use the version of python between 3.8 and 3.9 and use any version higher than 1.4.3 for pandas. What I like about poetry is that it makes sure that the whole dependency graph of the packages that you add is correct. If it can not solve the graph, then it fails fast and it fails hard, which is a good thing. This is probably a very bad explainer of what poetry does, but be sure to check it out! :) [1] https://python-poetry.org/ https://python-poetry.org/
- frafra 4y ago
  I tried, thanks! :) And I also suggest to evaluate PDM https://pdm.fming.dev/ https://pdm.fming.dev/
  - IanCal 4y ago
    I've been using PDM recently and although there have been a few issues I really like just cd'ing into a directory, running "python" and the correct set of packages being available.
    - wyuenho 4y ago
      Take a look at this: https://direnv.net/man/direnv-stdlib.1.html#codelayout-python-ltpythonexegtcode https://direnv.net/man/direnv-stdlib.1.html#codelayout-pytho...
- plonk 4y ago
  Isn't that the same as adding version constraints to setuptools' setup.cfg? [1] pip will use these in its dependency resolver. You can also constrain the Python version in there if you want. [1] https://setuptools.pypa.io/en/latest/userguide/quickstart.html#dependency-management https://setuptools.pypa.io/en/latest/userguide/quickstart.ht...
  - zelphirkalt 4y ago
    Maybe it is the same, but the idea is to take that selected version of the dependency and store a hash checksum for it, so that one can later get the exact same dependencies. Poetry only does not source setup.cfg, but its tool-specific config file. This way it stays out of the way of any other tool.
    - orzig 4y ago
      pip-tools can hash as well: https://pip-tools.readthedocs.io/en/latest/#using-hashes https://pip-tools.readthedocs.io/en/latest/#using-hashes Using a tool specific config file seems like a design choice with upsides and downsides, which I respect
      - westurner 4y ago
        A Pipfile can store hashes for multiple versions of a package built for multiple architectures; whereas requirements.txt can only store the hash of one version of the package on one platform. Can a requirements.txt or a Pipfile store cryptographically-signed hashes for each dependency? Which tool would check that not PyPI-upload but package-builder-signing keys validate? FWIU, nobody ever added GPG .asc signature support to Pip? What keys would it trust for which package? Should twine download after upload and check the publisher and PyPI-upload signatures?
        zelphirkalt 4y ago
        Are cryptographically-signed hashes really necessary in this case (why?)? What would be the secret, which is used for signing?
- crucialfelix 4y ago
  Hatch is also interesting and very similar to Poetry. https://hatch.pypa.io/latest/ https://hatch.pypa.io/latest/ In comparison to poetry I think it includes more advanced multi-environment and multi-python-version support and a tox-like testing matrix. It probably gets a little too complex there. It also works with pyproject.toml If anyone else has experience with Hatch vs Poetry please share!
  - wyuenho 4y ago
    You can't lock your dependencies with Hatch. https://hatch.pypa.io/latest/meta/faq/#libraries-vs-applications https://hatch.pypa.io/latest/meta/faq/#libraries-vs-applicat...
- wyuenho 4y ago
  Poetry is good, I'll hit a bug in poetry from time to time but it's improving quickly. Direnv is better, direnv layout will automatically create a hidden virtualenv directory on your work tree and sets up your path when you cd into it. The only downside is it doesn't seem to work on Windows.
  - athorax 4y ago
    I don't see the link between poetry and direnv? Poetry is about solving python's dependency issues, direnv doesn't seem to have anything to do with that
    - wyuenho 4y ago
      Set up direnv, and then: cd /your/project && echo "layout python" > .envrc && direnv allow Give it a go then tell me what the point is for any of these poetry/pipenv/hatch/flit/pdm/pyflow thingy if neither you or your teammates work on Windows.
      - barefeg 4y ago
        When your project depends on a module version and that module depends on another one (sub dependency), it’s very common that re-installing the same module version in a new environment will cause something to break because the sub dependency was updated. This is not something that direnv solves therefore those other tools are still needed.
        wyuenho 4y ago
        pip freeze > requirements.txt
        barefeg 4y ago
        Then you lose track of which are actual dependencies and which are sub dependencies
- datatrashfire 4y ago
  My least favorite part about poetry is how slow it is.
  - Tainnor 4y ago
    I seem to remember that some part of poetry's slowness is due to how the python index works and is therefore a problem shared by all such tools. That said, I've used both pipenv and poetry, and I had projects where pipenv would simply time out when trying to resolve packages. I haven't seen the same behaviour with poetry (indeed, that was the reason I migrated one project from pipenv to poetry after I just had to give up with the former).
- ak217 4y ago
  Poetry has a major issue with its lockfiles when working with active projects. It generates a top level dependency listing checksum, which causes any two PRs/branches that independently update the top level requirements to conflict with each other. The related issue, https://github.com/python-poetry/poetry/issues/496 https://github.com/python-poetry/poetry/issues/496, has been open for 4 years with no movement. The other issue with Poetry is that it uses its own pyproject.toml dependency listing format instead of the one standardized in the relevant PEP (https://peps.python.org/pep-0621/ https://peps.python.org/pep-0621/). This is understandable for historical reasons (Poetry was first written before this was standardized), but Poetry should have been updated to support the standard format. A relatively minor issue, but the poetry shell command is also a footgun. It's presented as a way to configure your shell to activate the virtualenv for the project. In reality it's a very slow, barely functional terminal emulator running on top of your terminal, which will cause problems for any programs that assume a working terminal or talk to the tty directly.
  - wyuenho 4y ago
    https://twitter.com/SDisPater/status/1521932867214921728 https://twitter.com/SDisPater/status/1521932867214921728 poetry shell is also not a term emulator, it's just a subshell with some environment variables setup for your project. Once you are in, it's just a regular shell. If anything is slow, it's where you add or remove a dependency, but it's probably faster than you editing requirements.txt, clearing out your virtualenv and then reinstalling everything again.
    - ak217 4y ago
      https://github.com/python-poetry/poetry/blob/master/src/poetry/utils/shell.py https://github.com/python-poetry/poetry/blob/master/src/poet... The process spawned by `poetry shell` is a terminal emulator driven by the pexpect and cleo packages. It hijacks and proxies the user's keystrokes before sending them to the underlying terminal.
      - wyuenho 4y ago
        Cleo creates "subcommands" in a git like manner, whereas pexpect spawns a subshell. That cleo Terminal class you see is only a viewport. A terminal emulator will be something substantially more complex such as libvterm. If it ain't handling terminfo, it ain't a terminal emulator. https://launchpad.net/libvterm https://launchpad.net/libvterm
- Doxin 4y ago
  > What I like about poetry is that it makes sure that the whole dependency graph of the packages that you add is correct. As does pip these days.
webjunkie 4y ago
Pip-Tools is great for pinning and freezing with hashes. Does what it should. So much faster than pipenv or poetry. Never looked back.
- wyuenho 4y ago
  You still need something else to manage your python versions and virtualenvs tho, and then as soon as you've pick a solution for the latter two problems, chances are you'll discover these tools also have a lock files that'll solve the problem of freezing packages and enabling reproducable builds for you.
  - kroolik 4y ago
    What about just throwing every thing into docker?
    - orzig 4y ago
      Docker is good at what it is good app, but sometimes I don’t want to deal with a whole other system just want to share code with five coworkers
    - wyuenho 4y ago
      That would be the "something else" :) If you don't want to fire up docker, you'll have to look elsewhere other than just pip-tool
- epage 4y ago
  Until you need a platform or Python version agnostic lock file. pip-tools compiles the list for your current environment which makes it limited.
  - orzig 4y ago
    This is interesting; can you expand or point to some documentation? I don’t have this design requirement right not, so I’m trying to understand any growing pains I might be locking myself into
Alex3917 4y ago
FWIW I have a code snippet in a pip-tools issue that will list only the outdated root dependencies in requirements.in: https://github.com/jazzband/pip-tools/issues/1167 https://github.com/jazzband/pip-tools/issues/1167 I personally find it extremely useful when upgrading dependencies.
deleted 4y ago
[deleted]
orzig 4y ago
I just discovered this after using (and being annoyed by) pipenv. I’ve heard good things about poetry, but I guess my big mystery is why either of them even exist when tools seems to pre-date?
- ak217 4y ago
  pip-tools has a minimalistic design philosophy, while poetry and pipenv have a maximalistic one. In other words, pip-tools tries to do one thing well, while poetry and pipenv try to do about a dozen different things well and have various opinions on how to do them. Minimalistic tools often lose out to maximalistic ones in the short term, only to win out in the long term as the maximalistic ones lose the momentum and resources needed to maintain their feature set. pip-tools was never advertised as well as poetry or pipenv, despite in my opinion being a better tool for the job, and having a best-in-class dependency resolver.
  - Tainnor 4y ago
    > Minimalistic tools often lose out to maximalistic ones in the short term, only to win out in the long term as the maximalistic ones lose the momentum and resources needed to maintain their feature set. I don't think this is true. Pipenv and poetry's feature set largely coincides with the feature set of similar tools in other languages (e.g. bundler, cargo). Some such tools have even larger feature sets (e.g. maven, gradle). Nonetheless, these tools haven't lost out to "smaller tools", but have become standard tools in their respective communities. The problem in the Python ecosystem is fragmentation. Nobody can agree on what the right tool for the job is, so everyone uses something different, dependencies/projects don't always work well with all tools, etc.
arunkant 4y ago
We are migrating our company codebase to bazel which uses this and it is quite helpful. Hermetic builds are nice and all devs share same versions of packages so reproducing bugs is easy
Bullfight2Cond 4y ago
pip-tools is alright but it doesn't support cross-platform (or python version) lockfiles. poetry is alright but it doesn't support the latest PEP standards, and its slow. PDM is where it's at; it's fast, has a really responsive maintainer, supports all the latest PEP standards, and has really good cross-platform support. pdm.fming.dev/
- adamc 4y ago
  PEP 582 is only a DRAFT, though. Not sure I want to sign on to a solution that might undergo substantial revision or be rejected.
  - adamc 4y ago
    This exchange makes me a bit skeptical. Is there later news? https://twitter.com/mkennedy/status/1375242144135270403?lang=en https://twitter.com/mkennedy/status/1375242144135270403?lang...
rbanffy 4y ago
Shameless plug: I built pip-chill to help me generate less stringent (and shorter) requirements.txt files. Its main use is to remove "noise" - packages required by other packages that you don't care about - but it can also remove version numbers (which is useful for testing against the latest and greatest).
ryandvm 4y ago
I've been writing Python forEVER and the one thing I fail to comprehend about it is how the dependency situation on Python only gets worse. It has somehow surpassed pre-nvm Node for being a total dependency clusterfuck. What are we using now? Pip? Pyenv? Pipenv? Poetry? Hatch? Conda? Once that's settled, there's invariable some library that has some native buildchain tooling requirement that isn't satisfied and the build process has shat all over my terminal. So now I have to hunt down whatever libraries gcc is complaining about. Christ, it should be against the law to release a programming language that doesn't have dependency management built-in.
- mountainriver 4y ago
  100% I switch between Go and Python a lot and even with Go mods detractions it’s still so much simpler to have everyone using one package manager built into the standard toolchain
- orf 4y ago
  Poetry is all you need.
- BerislavLopac 4y ago
  > What are we using now? > > Pip? Of course, for standard package installation. > Pyenv? Yes, if you need multiple Python versions available on the same system. > Pipenv? God no. https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-lot-delivers-very-little/ https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-l... > Poetry? Hatch? Yes, for local environment management and library dependency configuration. > Conda? Not really, unless you're doing data science and are heavily invested in the rest of Anaconda ecosystem. I don't really understand where the confusion is coming from - Python is used in a wide number of use cases and scenarios, and it is no surprise that there are many different tools in the box, each solving a different subset of problems. The packaging issue has been all but resolved in recent years, with the advent of wheels, pyproject.toml and a number of other standards. > So now I have to hunt down whatever libraries gcc is complaining about. Which has nothing to do with Python.

55 points by BerislavLopac 4y ago

Did you ever try poetry[1]? It is a great tool that I use in all my projects. It effectively solves dependency management for me in a very easy to use way. Dependency management using requirements.txt used to give me such a headache, now I just have a pyproject.toml that I know works. [tool.poetry.dependencies] python = ">=3.8,<3.9" pandas = "^1.4.3" This basically means: Use the version of python between 3.8 and 3.9 and use any version higher than 1.4.3 for pandas. What I like about poetry is that it makes sure that the whole dependency graph of the packages that you add is correct. If it can not solve the graph, then it fails fast and it fails hard, which is a good thing. This is probably a very bad explainer of what poetry does, but be sure to check it out! :) [1] https://python-poetry.org/ https://python-poetry.org/

frafra 4y ago
I tried, thanks! :) And I also suggest to evaluate PDM https://pdm.fming.dev/ https://pdm.fming.dev/
- IanCal 4y ago
  I've been using PDM recently and although there have been a few issues I really like just cd'ing into a directory, running "python" and the correct set of packages being available.
  - wyuenho 4y ago
    Take a look at this: https://direnv.net/man/direnv-stdlib.1.html#codelayout-python-ltpythonexegtcode https://direnv.net/man/direnv-stdlib.1.html#codelayout-pytho...
plonk 4y ago
Isn't that the same as adding version constraints to setuptools' setup.cfg? [1] pip will use these in its dependency resolver. You can also constrain the Python version in there if you want. [1] https://setuptools.pypa.io/en/latest/userguide/quickstart.html#dependency-management https://setuptools.pypa.io/en/latest/userguide/quickstart.ht...
- zelphirkalt 4y ago
  Maybe it is the same, but the idea is to take that selected version of the dependency and store a hash checksum for it, so that one can later get the exact same dependencies. Poetry only does not source setup.cfg, but its tool-specific config file. This way it stays out of the way of any other tool.
  - orzig 4y ago
    pip-tools can hash as well: https://pip-tools.readthedocs.io/en/latest/#using-hashes https://pip-tools.readthedocs.io/en/latest/#using-hashes Using a tool specific config file seems like a design choice with upsides and downsides, which I respect
    - westurner 4y ago
      A Pipfile can store hashes for multiple versions of a package built for multiple architectures; whereas requirements.txt can only store the hash of one version of the package on one platform. Can a requirements.txt or a Pipfile store cryptographically-signed hashes for each dependency? Which tool would check that not PyPI-upload but package-builder-signing keys validate? FWIU, nobody ever added GPG .asc signature support to Pip? What keys would it trust for which package? Should twine download after upload and check the publisher and PyPI-upload signatures?
      - zelphirkalt 4y ago
        Are cryptographically-signed hashes really necessary in this case (why?)? What would be the secret, which is used for signing?
crucialfelix 4y ago
Hatch is also interesting and very similar to Poetry. https://hatch.pypa.io/latest/ https://hatch.pypa.io/latest/ In comparison to poetry I think it includes more advanced multi-environment and multi-python-version support and a tox-like testing matrix. It probably gets a little too complex there. It also works with pyproject.toml If anyone else has experience with Hatch vs Poetry please share!
- wyuenho 4y ago
  You can't lock your dependencies with Hatch. https://hatch.pypa.io/latest/meta/faq/#libraries-vs-applications https://hatch.pypa.io/latest/meta/faq/#libraries-vs-applicat...
wyuenho 4y ago
Poetry is good, I'll hit a bug in poetry from time to time but it's improving quickly. Direnv is better, direnv layout will automatically create a hidden virtualenv directory on your work tree and sets up your path when you cd into it. The only downside is it doesn't seem to work on Windows.
- athorax 4y ago
  I don't see the link between poetry and direnv? Poetry is about solving python's dependency issues, direnv doesn't seem to have anything to do with that
  - wyuenho 4y ago
    Set up direnv, and then: cd /your/project && echo "layout python" > .envrc && direnv allow Give it a go then tell me what the point is for any of these poetry/pipenv/hatch/flit/pdm/pyflow thingy if neither you or your teammates work on Windows.
    - barefeg 4y ago
      When your project depends on a module version and that module depends on another one (sub dependency), it’s very common that re-installing the same module version in a new environment will cause something to break because the sub dependency was updated. This is not something that direnv solves therefore those other tools are still needed.
      - wyuenho 4y ago
        pip freeze > requirements.txt
        barefeg 4y ago
        Then you lose track of which are actual dependencies and which are sub dependencies
datatrashfire 4y ago
My least favorite part about poetry is how slow it is.
- Tainnor 4y ago
  I seem to remember that some part of poetry's slowness is due to how the python index works and is therefore a problem shared by all such tools. That said, I've used both pipenv and poetry, and I had projects where pipenv would simply time out when trying to resolve packages. I haven't seen the same behaviour with poetry (indeed, that was the reason I migrated one project from pipenv to poetry after I just had to give up with the former).
ak217 4y ago
Poetry has a major issue with its lockfiles when working with active projects. It generates a top level dependency listing checksum, which causes any two PRs/branches that independently update the top level requirements to conflict with each other. The related issue, https://github.com/python-poetry/poetry/issues/496 https://github.com/python-poetry/poetry/issues/496, has been open for 4 years with no movement. The other issue with Poetry is that it uses its own pyproject.toml dependency listing format instead of the one standardized in the relevant PEP (https://peps.python.org/pep-0621/ https://peps.python.org/pep-0621/). This is understandable for historical reasons (Poetry was first written before this was standardized), but Poetry should have been updated to support the standard format. A relatively minor issue, but the poetry shell command is also a footgun. It's presented as a way to configure your shell to activate the virtualenv for the project. In reality it's a very slow, barely functional terminal emulator running on top of your terminal, which will cause problems for any programs that assume a working terminal or talk to the tty directly.
- wyuenho 4y ago
  https://twitter.com/SDisPater/status/1521932867214921728 https://twitter.com/SDisPater/status/1521932867214921728 poetry shell is also not a term emulator, it's just a subshell with some environment variables setup for your project. Once you are in, it's just a regular shell. If anything is slow, it's where you add or remove a dependency, but it's probably faster than you editing requirements.txt, clearing out your virtualenv and then reinstalling everything again.
  - ak217 4y ago
    https://github.com/python-poetry/poetry/blob/master/src/poetry/utils/shell.py https://github.com/python-poetry/poetry/blob/master/src/poet... The process spawned by `poetry shell` is a terminal emulator driven by the pexpect and cleo packages. It hijacks and proxies the user's keystrokes before sending them to the underlying terminal.
    - wyuenho 4y ago
      Cleo creates "subcommands" in a git like manner, whereas pexpect spawns a subshell. That cleo Terminal class you see is only a viewport. A terminal emulator will be something substantially more complex such as libvterm. If it ain't handling terminfo, it ain't a terminal emulator. https://launchpad.net/libvterm https://launchpad.net/libvterm
Doxin 4y ago
> What I like about poetry is that it makes sure that the whole dependency graph of the packages that you add is correct. As does pip these days.

webjunkie 4y ago

Pip-Tools is great for pinning and freezing with hashes. Does what it should. So much faster than pipenv or poetry. Never looked back.

wyuenho 4y ago
You still need something else to manage your python versions and virtualenvs tho, and then as soon as you've pick a solution for the latter two problems, chances are you'll discover these tools also have a lock files that'll solve the problem of freezing packages and enabling reproducable builds for you.
- kroolik 4y ago
  What about just throwing every thing into docker?
  - orzig 4y ago
    Docker is good at what it is good app, but sometimes I don’t want to deal with a whole other system just want to share code with five coworkers
  - wyuenho 4y ago
    That would be the "something else" :) If you don't want to fire up docker, you'll have to look elsewhere other than just pip-tool
epage 4y ago
Until you need a platform or Python version agnostic lock file. pip-tools compiles the list for your current environment which makes it limited.
- orzig 4y ago
  This is interesting; can you expand or point to some documentation? I don’t have this design requirement right not, so I’m trying to understand any growing pains I might be locking myself into

Alex3917 4y ago

FWIW I have a code snippet in a pip-tools issue that will list only the outdated root dependencies in requirements.in: https://github.com/jazzband/pip-tools/issues/1167 https://github.com/jazzband/pip-tools/issues/1167 I personally find it extremely useful when upgrading dependencies.

deleted 4y ago

[deleted]

orzig 4y ago

I just discovered this after using (and being annoyed by) pipenv. I’ve heard good things about poetry, but I guess my big mystery is why either of them even exist when tools seems to pre-date?

ak217 4y ago
pip-tools has a minimalistic design philosophy, while poetry and pipenv have a maximalistic one. In other words, pip-tools tries to do one thing well, while poetry and pipenv try to do about a dozen different things well and have various opinions on how to do them. Minimalistic tools often lose out to maximalistic ones in the short term, only to win out in the long term as the maximalistic ones lose the momentum and resources needed to maintain their feature set. pip-tools was never advertised as well as poetry or pipenv, despite in my opinion being a better tool for the job, and having a best-in-class dependency resolver.
- Tainnor 4y ago
  > Minimalistic tools often lose out to maximalistic ones in the short term, only to win out in the long term as the maximalistic ones lose the momentum and resources needed to maintain their feature set. I don't think this is true. Pipenv and poetry's feature set largely coincides with the feature set of similar tools in other languages (e.g. bundler, cargo). Some such tools have even larger feature sets (e.g. maven, gradle). Nonetheless, these tools haven't lost out to "smaller tools", but have become standard tools in their respective communities. The problem in the Python ecosystem is fragmentation. Nobody can agree on what the right tool for the job is, so everyone uses something different, dependencies/projects don't always work well with all tools, etc.

arunkant 4y ago

We are migrating our company codebase to bazel which uses this and it is quite helpful. Hermetic builds are nice and all devs share same versions of packages so reproducing bugs is easy

Bullfight2Cond 4y ago

pip-tools is alright but it doesn't support cross-platform (or python version) lockfiles. poetry is alright but it doesn't support the latest PEP standards, and its slow. PDM is where it's at; it's fast, has a really responsive maintainer, supports all the latest PEP standards, and has really good cross-platform support. pdm.fming.dev/

adamc 4y ago
PEP 582 is only a DRAFT, though. Not sure I want to sign on to a solution that might undergo substantial revision or be rejected.
- adamc 4y ago
  This exchange makes me a bit skeptical. Is there later news? https://twitter.com/mkennedy/status/1375242144135270403?lang=en https://twitter.com/mkennedy/status/1375242144135270403?lang...

rbanffy 4y ago

Shameless plug: I built pip-chill to help me generate less stringent (and shorter) requirements.txt files. Its main use is to remove "noise" - packages required by other packages that you don't care about - but it can also remove version numbers (which is useful for testing against the latest and greatest).

ryandvm 4y ago

I've been writing Python forEVER and the one thing I fail to comprehend about it is how the dependency situation on Python only gets worse. It has somehow surpassed pre-nvm Node for being a total dependency clusterfuck. What are we using now? Pip? Pyenv? Pipenv? Poetry? Hatch? Conda? Once that's settled, there's invariable some library that has some native buildchain tooling requirement that isn't satisfied and the build process has shat all over my terminal. So now I have to hunt down whatever libraries gcc is complaining about. Christ, it should be against the law to release a programming language that doesn't have dependency management built-in.

mountainriver 4y ago
100% I switch between Go and Python a lot and even with Go mods detractions it’s still so much simpler to have everyone using one package manager built into the standard toolchain
orf 4y ago
Poetry is all you need.
BerislavLopac 4y ago
> What are we using now? > > Pip? Of course, for standard package installation. > Pyenv? Yes, if you need multiple Python versions available on the same system. > Pipenv? God no. https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-lot-delivers-very-little/ https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-l... > Poetry? Hatch? Yes, for local environment management and library dependency configuration. > Conda? Not really, unless you're doing data science and are heavily invested in the rest of Anaconda ecosystem. I don't really understand where the confusion is coming from - Python is used in a wide number of use cases and scenarios, and it is no surprise that there are many different tools in the box, each solving a different subset of problems. The packaging issue has been all but resolved in recent years, with the advent of wheels, pyproject.toml and a number of other standards. > So now I have to hunt down whatever libraries gcc is complaining about. Which has nothing to do with Python.