4 ms·
Have a look at the diagram in the accompanying blog post https://medium.com/data-science-collective/pipask-know-what-youre-installing-before-it-s-too-late-2a6af
by Feynmanix 1y ago
Have a look at the diagram in the accompanying blog post https://medium.com/data-science-collective/pipask-know-what-youre-installing-before-it-s-too-late-2a6afce80987#7ae4 https://medium.com/data-science-collective/pipask-know-what-... , it explains how the process works.
In short, you can get metadata from pyproject.toml, but (a) it can still involve executing code due to PEP 517 hooks, and (b) a malicious package would use the legacy setup.py to get their code executed.
- pseufaux 1y agoThat's a super helpful diagram. Saved it for later in case I have to explain to someone else. Thank you. I can see why something like pipask would be helpful. I saw in another comment that you are looking to make a uv plugin. I'll be on the lookout for that getting released!