<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 17/01/14 13:52, Hannes Schmidt wrote:<br>
<blockquote
cite="mid:CAGBbXtDwjFbY-Uijz+T16WfY8shCJbOBUV+10TyjCnP2at6DHw@mail.gmail.com"
type="cite">
<div dir="ltr">I read through the "Removing dependency_links"
thread [1] and I beg you not follow through with the deprecation
and removal of dependency_links and to rethink your approach.
<div><br>
</div>
<div>The mentioned thread indicates that research was done to
gauge the popularity of the dependency_links in publicly
hosted Python projects. That approach is fundamentally flawed:
Publicly hosted projects are much more likely to also be
available on PyPI than private, closed-source projects.
Consequently, their dependencies are also more likely to be
hosted on PyPI as well. Because of that, they are much less
likely to rely on the dependency_links feature. </div>
<div><br>
</div>
<div>Another misconception seem to be that dependency_links is
predominantly used for installing patched or customized
versions of dependencies hosted on PyPI. I'm pretty sure the
predominant use case for dependency_links is with projects
that are hosted privately, e.g. for an organization's internal
use. I represent such an organization and removing
dependency_links would impact us negatively. We host a set of
internal projects and their dependencies on Bitbucket and we
rely on dependency_links to install them directly from there.</div>
<div><br>
</div>
<div>I understand the motivation for this change – security –
but there must be smarter way to handle it. Could we fallback
to dependency_links if a PyPI lookup isn't successful? Could
we restrict dependency_links to links that share a prefix with
the link from which the package is currently being installed?
A combination of the two?</div>
<div><br>
</div>
<div>
<div>[1]: <a moz-do-not-send="true"
href="https://mail.python.org/pipermail/distutils-sig/2013-October/022937.html">https://mail.python.org/pipermail/distutils-sig/2013-October/022937.html</a><br
clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">Hannes Schmidt<br>
Software Application Developer<br>
Data Migration Engineer<br>
Cancer Genomics Hub<br>
University of California, Santa Cruz<br>
<br>
(206) 696-2316 (cell)<br>
<a moz-do-not-send="true" href="mailto:hannes@ucsc.edu"
target="_blank">hannes@ucsc.edu</a></div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Distutils-SIG maillist - <a class="moz-txt-link-abbreviated" href="mailto:Distutils-SIG@python.org">Distutils-SIG@python.org</a>
<a class="moz-txt-link-freetext" href="https://mail.python.org/mailman/listinfo/distutils-sig">https://mail.python.org/mailman/listinfo/distutils-sig</a>
</pre>
</blockquote>
<br>
Are you aware that you can also provide a solid infrastructure for a
"proprietary environment of packages" by hosting your own private
pypi mirror?<br>
<br>
There are quite a few projects that enable this, such as<br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://pypi.python.org/pypi/pypiserver">https://pypi.python.org/pypi/pypiserver</a><br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://pypi.python.org/pypi/mypypi">https://pypi.python.org/pypi/mypypi</a><br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://github.com/steiza/simplepypi">https://github.com/steiza/simplepypi</a><br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://djangopypi2.readthedocs.org/en/latest/">http://djangopypi2.readthedocs.org/en/latest/</a><br>
<br>
You can use the -i flag, or a .pypirc config file to tell pip to
look at your own private index instead of the official one; or
direct it to use the official pypi only after looking at your
private pypi.<br>
<br>
You can also host a network-available folder of wheels for pip to
find, or simply a http accessible folder of packages as Donald
suggested.
<pre class="moz-signature" cols="72">--
Matt Iversen
PGP: 0xc046e8a874522973 // 2F04 3DCC D6E6 D5AC D262 2E0B C046 E8A8 7452 2973</pre>
</body>
</html>