3 ms·
Pip and similar are their own can of worms yeah. They trade convinience for an almost complete lack of oversight. But in this case we are talking about people
by im3w1l 3y ago
Pip and similar are their own can of worms yeah. They trade convinience for an almost complete lack of oversight.
But in this case we are talking about people (distro packagers) manually downloading the source and building it which is not quite the same thing.
- Denvercoder9 3y ago`pip install` does do exactly the same thing: it downloads and executes code from a tarball uploaded to PyPi by its maintainer. There's no verification process that ensures that tarball matches what's in the git repository.
- im3w1l 3y agoYes I know, and that's what I meant when I said "their own can of worms". Distro-provided python packages don't use pip however, at least afaik.
- Denvercoder9 3y agoThe distro-provided Python packages are usually still build from the source on PyPi as uploaded by the maintainer, not what's in git.