<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 24, 2013, at 9:54 AM, holger krekel <<a href="mailto:holger@merlinux.eu">holger@merlinux.eu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Fri, May 24, 2013 at 07:20 -0400, Donald Stufft wrote:<br><blockquote type="cite">On May 24, 2013, at 7:17 AM, Vinay Sajip <<a href="mailto:vinay_sajip@yahoo.co.uk">vinay_sajip@yahoo.co.uk</a>> wrote:<br><br><blockquote type="cite"><blockquote type="cite">From: holger krekel <<a href="mailto:holger@merlinux.eu">holger@merlinux.eu</a>><br></blockquote><br><br><blockquote type="cite"><br>Nice. How do you actually get at the dependencies? Don't you<br>need to execute setup.py for that?<br><br></blockquote><br>Yes, that's how it's done. However, the idea is to do it once per uploaded release and remember the results, so an installer tool like pip doesn't have to download and run setup.py every time :-)<br></blockquote><br>So what you're saying is I can root your machine with a setup.py? ;)<br></blockquote><br>That's the immediate risk, indeed :) However, i guess one could use a VM<br>with a chroot and a dedicated user and timeout the setup after 20 seconds<br>or so to regain some safety. It's a bit horrible but OTOH i'd really<br>like to have this information (especially the deps) without requiring <br>everybody to switch to a new packaging format first.<br><br>holger<br></blockquote></div><br><div>Most packages also have an egg-info inside of them you can parse.</div><div><br></div><div>Of course the issue is that you're only going to get the requirements of the system that ran setup.py, either the authors or the servers. Which doesn't accurately represent all of the dependencies all of the time.</div><div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br class="Apple-interchange-newline">-----------------</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Donald Stufft</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</div>
</div>
<br></body></html>