4 ms·
I've been using pip-compile from https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools for this use case; a standard project Makefile defi
by gegtik 4y ago
I've been using pip-compile from https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools for this use case; a standard project Makefile defines "make update" which pip-compiles the current requirements, and "make install" installs the frozen requirements list.
This way I can install the same bill of materials every time
- r9295 4y agoI think we have different motivations. pip-compile can only fetch and install dependencies which have been declared. For example, let's say I have a malicious yaml parser package. It should not need requests as a dependency. The odds are that a project may have requests already installed as a sub-dependency of another dependency. I can then just try and import requests in a try catch block and if available, and fetch malicious artefacts, for example. Panoptisch would report this. Also, the usage of operating system or builtin modules such as socket, sys or importlib is not something which is analyzed by pip-compile.