3 ms·
Another thing I think might help is (a) Discourage any future use of ">=" in version dependencies. Specify an exact version. That way a future compromised vers
by dheera 4y ago
Another thing I think might help is
(a) Discourage any future use of ">=" in version dependencies. Specify an exact version. That way a future compromised version doesn't get pulled
(b) Every build system needs better ways of having multiple versions of a same dependency coexist. I should be able to have one of my project's dependencies depend on "numpy==1.15" and another dependency depend on "numpy==1.16" and they should be able to coexist in the SAME environment and "see" exactly the numpy versions they requested.
For python we should think about how to support something like this in the future:
import numpy==1.15
and have it just work.
That way if a hacker compromises PyPI and releases a malicious numpy 1.19 it won't get pulled in accidentally.
Here's a bit of a joke I made before that might be an interesting starting point, though since it uses virtualenv behind the hood it doesn't have a way for multiple versions of one package to exist. I don't think it's impossible to do though with some additional work.
https://github.com/dheera/magicimport.py https://github.com/dheera/magicimport.py
Sample code:
from magicimport import magicimport
tornado = magicimport("tornado", version = "4.5")
- cozzyd 4y agoWould you run into dynamic linker problems in this case due to symbol conflicts? Or does symbol versioning magically resolve that somehow?
- dheera 4y agoPrefix all symbols with versions? foo() becomes v1_15_4_foo() automatically
- MikePlacid 4y ago> I should be able to have one of my project's dependencies depend on "numpy==1.15" and another dependency depend on "numpy==1.16" and they should be able to coexist in the SAME environment Now I see what people at one respectable, big project were thinking when they allowed 7 different versions of OpenSSL to be statically linked to the same executable… Seriously, this idea may save you from some not very interesting work, but it will create the need of much bigger amount of work which while potentially interesting is not very productive. You are toying with exponential growth here, like a chain reaction - like a bomb.