3 ms·

Have you tried using pip? Or, reading the documentation? It has more features than just "install." You could try running python -m pip check To check depen

Have you tried using pip? Or, reading the documentation? It has more features than just "install." You could try running python -m pip check To check dependencies. Or, python -m pip inspect To get a JSON output of your current virtual environment. Or, update stuff automatically: python -m pip install --upgrade Or, skip worrying about dependencies: python -m pip install --no-deps Or, do a dry run installation with full report on what would be installed: pip install --ignore-installed --dry-run --quiet --report And, there's a lot more than that. Pip is pretty powerful and I'm surprised everyone dislikes it so much. Hope this helps. Cheers!

zahlman 2y ago
In principle, yes. In practice, there are a lot of issues with that workflow. For example, `pip install --ignore-installed --dry-run --quiet --report` will build sdists (and run arbitrary code from `setup.py` or other places specified by a build backend) - just so that it can confirm that the downloaded sdist would produce a wheel with the right name and version. Even `pip download` will do the same. I'm not kidding. There are multiple outstanding issues on the tracker that are all ultimately about this problem, which has persisted through multiple versions of the UI and all the evolving packaging standards, going back almost the entire history of Pip. See for example https://github.com/pypa/pip/issues/1884 https://github.com/pypa/pip/issues/1884 ; I have a long list of related reports written down somewhere. A security researcher was once infamously bitten by this (https://moyix.blogspot.com/2022/09/someones-been-messing-with-my-subnormals.html https://moyix.blogspot.com/2022/09/someones-been-messing-wit...).
daemonologist 2y ago
I appreciate the suggestions, unfortunately my problems aren't really with pip. It's more that packages ship over- or under-specific version requirements (e.g. dependency A wants numpy == 1.24.1, dependency B wants numpy >= 1.24 but actually doesn't work with 1.24.1 for some obscure reason (the authors probably didn't have A installed so they only tested with 1.24.2 and 1.26), but A actually will work fine with 1.25 so you need to override the 1.24.1 requirement). Or sometimes they have perfectly accurate but incompatible requirements and there's no standard or even good way to reconcile them.

zahlman 2y ago

In principle, yes. In practice, there are a lot of issues with that workflow. For example, `pip install --ignore-installed --dry-run --quiet --report` will build sdists (and run arbitrary code from `setup.py` or other places specified by a build backend) - just so that it can confirm that the downloaded sdist would produce a wheel with the right name and version. Even `pip download` will do the same. I'm not kidding. There are multiple outstanding issues on the tracker that are all ultimately about this problem, which has persisted through multiple versions of the UI and all the evolving packaging standards, going back almost the entire history of Pip. See for example https://github.com/pypa/pip/issues/1884 https://github.com/pypa/pip/issues/1884 ; I have a long list of related reports written down somewhere. A security researcher was once infamously bitten by this (https://moyix.blogspot.com/2022/09/someones-been-messing-with-my-subnormals.html https://moyix.blogspot.com/2022/09/someones-been-messing-wit...).

daemonologist 2y ago

I appreciate the suggestions, unfortunately my problems aren't really with pip. It's more that packages ship over- or under-specific version requirements (e.g. dependency A wants numpy == 1.24.1, dependency B wants numpy >= 1.24 but actually doesn't work with 1.24.1 for some obscure reason (the authors probably didn't have A installed so they only tested with 1.24.2 and 1.26), but A actually will work fine with 1.25 so you need to override the 1.24.1 requirement). Or sometimes they have perfectly accurate but incompatible requirements and there's no standard or even good way to reconcile them.