3 ms·

Holy hell dude, you don’t need to write a novel for every reply. It’s not a lockfile because it’s a snapshot of what you have installed. End of. It doesn’t han

by orf 2y ago

Holy hell dude, you don’t need to write a novel for every reply. It’s not a lockfile because it’s a snapshot of what you have installed. End of. It doesn’t handle environment markers nor is it reproducible. Given any non-trivial set of dependencies and/or more than 1 platform, it will lead to confusing issues. Those confusing issues are the reason for lock files to exist, and the reason they are not just “the output of pip freeze”. But you know this, given your two years of extensive expert study. Which I see very little evidence of.

zahlman 2y ago
>It’s not a lockfile because it’s a snapshot of what you have installed. I didn't say it was. I said that it solves the problems that many people mistakenly think they need a lockfile for. (To be clear: did you notice that I am not the person who originally said "'pip freeze' generates a lockfile."?) >It doesn’t handle environment markers nor is it reproducible. You can write environment markers in it (of course you won't get them from `pip freeze`) and Pip will respect them. And there are plenty of cases where no environment markers are applicable anyway. It's perfectly reproducible insofar as you get the exact specified version of every dependency, including transitive dependencies. >Given any non-trivial set of dependencies and/or more than 1 platform, it will lead to confusing issues. Given more than 1 platform, with differences that actually matter (i.e. not pure-Python dependencies), you cannot use a lockfile, unless you specify to build everything from source. Because otherwise a lockfile would specify wheels as exact files with their hashes that were pre-built for one platform and will not work on the others. Anyway, feel free to show a minimal reproducible example of the confusion you have in mind.
- orf 2y ago
  > Given more than 1 platform, with differences that actually matter (i.e. not pure-Python dependencies), you cannot use a lockfile, unless you specify to build everything from source. Because otherwise a lockfile would specify wheels as exact files with their hashes that were pre-built for one platform and will not work on the others. What is more likely: 1. Using a lockfile means you cannot use wheels and have to build from source 2. You don’t know what you’re talking about (When deciding, keep in mind that every single lockfile consuming and producing tool works fine with wheels)

by orf 2y ago

zahlman 2y ago

>It’s not a lockfile because it’s a snapshot of what you have installed. I didn't say it was. I said that it solves the problems that many people mistakenly think they need a lockfile for. (To be clear: did you notice that I am not the person who originally said "'pip freeze' generates a lockfile."?) >It doesn’t handle environment markers nor is it reproducible. You can write environment markers in it (of course you won't get them from `pip freeze`) and Pip will respect them. And there are plenty of cases where no environment markers are applicable anyway. It's perfectly reproducible insofar as you get the exact specified version of every dependency, including transitive dependencies. >Given any non-trivial set of dependencies and/or more than 1 platform, it will lead to confusing issues. Given more than 1 platform, with differences that actually matter (i.e. not pure-Python dependencies), you cannot use a lockfile, unless you specify to build everything from source. Because otherwise a lockfile would specify wheels as exact files with their hashes that were pre-built for one platform and will not work on the others. Anyway, feel free to show a minimal reproducible example of the confusion you have in mind.

orf 2y ago
> Given more than 1 platform, with differences that actually matter (i.e. not pure-Python dependencies), you cannot use a lockfile, unless you specify to build everything from source. Because otherwise a lockfile would specify wheels as exact files with their hashes that were pre-built for one platform and will not work on the others. What is more likely: 1. Using a lockfile means you cannot use wheels and have to build from source 2. You don’t know what you’re talking about (When deciding, keep in mind that every single lockfile consuming and producing tool works fine with wheels)