3 ms·
`pip install` does do exactly the same thing: it downloads and executes code from a tarball uploaded to PyPi by its maintainer. There's no verification process
by Denvercoder9 3y ago
`pip install` does do exactly the same thing: it downloads and executes code from a tarball uploaded to PyPi by its maintainer. There's no verification process that ensures that tarball matches what's in the git repository.
- im3w1l 3y agoYes I know, and that's what I meant when I said "their own can of worms". Distro-provided python packages don't use pip however, at least afaik.
- Denvercoder9 3y agoThe distro-provided Python packages are usually still build from the source on PyPi as uploaded by the maintainer, not what's in git.