8 ms·

> It would not have happened in any modern language. It would. pip for example installs from tarballs uploaded to PyPi, not from a git repository.

• im3w1l 3y ago
  Pip and similar are their own can of worms yeah. They trade convinience for an almost complete lack of oversight. But in this case we are talking about people (distro packagers) manually downloading the source and building it which is not quite the same thing.
  • Denvercoder9 3y ago
    `pip install` does do exactly the same thing: it downloads and executes code from a tarball uploaded to PyPi by its maintainer. There's no verification process that ensures that tarball matches what's in the git repository.
    • im3w1l 3y ago
      Yes I know, and that's what I meant when I said "their own can of worms". Distro-provided python packages don't use pip however, at least afaik.
      • Denvercoder9 3y ago
        The distro-provided Python packages are usually still build from the source on PyPi as uploaded by the maintainer, not what's in git.