<div>Suggestions to help to minimize unnecessary logged bandwidth use and even work with a closed loop LAN:<br></div><div><br></div>This reads from the filesystem:<div><br></div><div> import requests</div><div><br></div><div>This would read from the PyPi service over the network bandwidth:</div><div><br></div><div> #!pip install -U requests</div><div> #%run pip install -U requests</div><div><br></div><div> #pip('install -U requests')</div><div><br></div><div>This doesn't work because you SHOULD restart the interpreter after running pip (because imports are cached):</div><div><br></div><div> import requests</div><div> !pip install -U requests</div><div> import requests<br><br>Some tips on running educational environments for beginners (optionally in a lab):</div><div><br></div><div>- IPython</div><div> - requests? # docstring</div><div> - requests?? # source</div><div> - !pydoc ipython</div><div> - %run pydoc ipython</div><div>- Spyder includes an IPython terminal</div><div> (``conda install spyder`` even installs Qt)</div><div>- Just use conda (and docker and binder)</div><div>- Aggressively cache network accesses (and/or just block internet access entirely)</div><div> - PIP_INDEX="<a href="https://pip.local/simple/">https://pip.local/simple/</a>"</div><div> - DevPi can transparently proxy cache packages from pypi (and then work without internet access)</div><div> - a local httpbin is easy to host within the LAN</div><div> </div><div>- Binder can provision Docker containers with conda and everything already installed (With Kubernetes and JupyterHub (and OAuth))</div><div> - Each person gets their own container</div><div> - Jupyter has a web terminal built in</div><div> - You can also just run the Docker container locally</div><div><br></div><div>#!pip install ipython scipy devpi certbot</div><div># Some back of the napkin calculations:</div><div># 30 users run a script which runs 2 pip install requests at least 5 times.</div><div># (These should be at the top)</div><div><br></div><div>These Docker containers are ready to go with everything you need for a lesson:</div><div><a href="https://github.com/jupyter/docker-stacks">https://github.com/jupyter/docker-stacks</a></div><div><br></div><div>You don't need this bash shell lesson if all you need to do is ``!pip install`` with IPython:</div><div><a href="https://swcarpentry.github.io/shell-novice/">https://swcarpentry.github.io/shell-novice/</a><br></div><div><br></div><div>A Tk GUI for pip would need to frustratingly duplicate ~/.bash_history and up-arrow to get the previous command.</div><div>(Qt and GTK are not consistently installed; though ``conda install spyder`` does install Qt (which is very accessible))</div><div><br></div><div>IDLE sucks.</div><div><br></div><div><a href="https://devpi.net/docs/devpi/devpi/stable/%2Bd/index.html">https://devpi.net/docs/devpi/devpi/stable/%2Bd/index.html</a><br></div><div><br></div><div><a href="https://github.com/kennethreitz/httpbin/blob/master/Dockerfile">https://github.com/kennethreitz/httpbin/blob/master/Dockerfile</a><br><br>These should pretty much get you started:</div><div><br></div><div><a href="https://github.com/jrjohansson/scientific-python-lectures">https://github.com/jrjohansson/scientific-python-lectures</a><br></div><div><br></div><div><a href="https://github.com/jrjohansson/scientific-python-lectures/blob/master/Lecture-0-Scientific-Computing-with-Python.ipynb">https://github.com/jrjohansson/scientific-python-lectures/blob/master/Lecture-0-Scientific-Computing-with-Python.ipynb</a><br></div><div><br></div><div><a href="https://github.com/jrjohansson/scientific-python-lectures/blob/master/Lecture-1-Introduction-to-Python-Programming.ipynb">https://github.com/jrjohansson/scientific-python-lectures/blob/master/Lecture-1-Introduction-to-Python-Programming.ipynb</a></div><div><br></div><div><a href="https://github.com/jrjohansson/scientific-python-lectures/blob/master/Lecture-7-Revision-Control-Software.ipynb">https://github.com/jrjohansson/scientific-python-lectures/blob/master/Lecture-7-Revision-Control-Software.ipynb</a><br><br><br>GitLab and Mattermost work with an offline LAN:</div><div><br></div><div><a href="https://docs.gitlab.com/omnibus/README.html">https://docs.gitlab.com/omnibus/README.html</a></div><div><a href="https://docs.gitlab.com/omnibus/docker/README.html#run-the-image">https://docs.gitlab.com/omnibus/docker/README.html#run-the-image</a></div><div><br></div><div>Binder can pull images from a GitLab Docker Container Registry:</div><div><a href="https://docs.gitlab.com/ce/user/project/container_registry.html">https://docs.gitlab.com/ce/user/project/container_registry.html</a></div><div><br></div><div>These suggestions should help to minimize unnecessary logged bandwidth use and even work with a closed loop LAN.<br><br>See: "#!pip install ipython scipy devpi certbot" in the middle of this email.<br><br>On Tuesday, October 31, 2017, Wes Turner <<a href="mailto:wes.turner@gmail.com">wes.turner@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span style="color:rgb(34,34,34);font-size:14px">You could teach them subprocess and os command injection safety from the start:</span><div style="color:rgb(34,34,34);font-size:14px"><br></div><div style="color:rgb(34,34,34);font-size:14px">```python</div><div style="color:rgb(34,34,34);font-size:14px">import subprocess</div><div style="color:rgb(34,34,34);font-size:14px">import sys</div><div style="color:rgb(34,34,34);font-size:14px">cmd = [sys.executable, -m', 'pip', 'install', '-r', 'psfblessed-requirements.txt']<wbr>)</div><div style="color:rgb(34,34,34);font-size:14px">retcode = subprocess.check_call(cmd)</div><div style="color:rgb(34,34,34);font-size:14px">assert retcode == 0</div><div style="color:rgb(34,34,34);font-size:14px">```</div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div style="color:rgb(34,34,34);font-size:14px">(Because shell=True is dangerous and str.split is dangerous):</div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div style="color:rgb(34,34,34);font-size:14px">```python</div><div style="color:rgb(34,34,34);font-size:14px">filename = "'/etc/ passwd' ; shutdown -r now"</div><div style="color:rgb(34,34,34);font-size:14px">cmd = ("cat '%s'" % filename)</div><div style="color:rgb(34,34,34);font-size:14px">cmd</div><div style="color:rgb(34,34,34);font-size:14px"># "cat ''/etc/ passwd'' ; shutdown -r now"</div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div style="color:rgb(34,34,34);font-size:14px">cmd.split()</div><div style="color:rgb(34,34,34);font-size:14px"># ["'", '/etc', 'passwd', ';', 'shutdown', '-r', 'now']</div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div style="color:rgb(34,34,34);font-size:14px">shlex.split(cmd)</div><div style="color:rgb(34,34,34);font-size:14px"># ['cmd', '', '/etc', 'passwd', ';', 'shutdown', '-r', 'now']</div><div style="color:rgb(34,34,34);font-size:14px">```</div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div style="color:rgb(34,34,34);font-size:14px">(Sarge solves for a number of additional cases beyond shlex.split (empty string should be '', 'already-quoted commands')</div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div><font color="#222222"><span style="font-size:14px"><a href="https://sarge.readthedocs.io/en/latest/overview.html#why-not-just-use-subprocess" target="_blank">https://sarge.readthedocs.io/<wbr>en/latest/overview.html#why-<wbr>not-just-use-subprocess</a></span></font><br></div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div><font color="#222222"><span style="font-size:14px"> <a href="https://en.wikipedia.org/wiki/Code_injection#Shell_injection" target="_blank">https://en.wikipedia.org/<wbr>wiki/Code_injection#Shell_<wbr>injection</a></span></font><br></div><div style="color:rgb(34,34,34);font-size:14px"><br></div><div><font color="#222222"><span style="font-size:14px"><a href="https://sarge.readthedocs.io/en/latest/internals.html#how-shell-quoting-works" target="_blank">https://sarge.readthedocs.io/<wbr>en/latest/internals.html#how-<wbr>shell-quoting-works</a></span></font><br></div><div><font color="#222222"><span style="font-size:14px"><br></span></font></div><div><font color="#222222"><span style="font-size:14px">Of course, we're programmers and our input is not untrusted, so shell=True without any string operations is not as dangerous.</span></font></div><div><br></div><br>On Tuesday, October 31, 2017, Wes Turner <<a href="javascript:_e(%7B%7D,'cvml','wes.turner@gmail.com');" target="_blank">wes.turner@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">You could teach them subprocess and os command injection safety from the start:<div><br></div><div>```python</div><div>import subprocess</div><div>import sys</div><div>cmd = [sys.executable, -m', 'pip', 'install', '-r', 'psfblessed-requirements.txt']<wbr>)</div><div>retcode = subprocess.check_call(cmd)</div><div>assert retcode == 0</div><div>```</div><div><br></div><div>(Because shell=True is dangerous)<br><br>On Tuesday, October 31, 2017, Terry Reedy <<a>tjreedy@udel.edu</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 10/31/2017 12:21 PM, Ivan Levkivskyi wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I think it was proposed several times before, but I just wanted to revive the idea that we could add<br>
a GUI interface to install/update packages from IDLE (maybe even with some package browser).<br>
</blockquote>
<br>
<a href="https://bugs.python.org/issue23551" target="_blank">https://bugs.python.org/issue2<wbr>3551</a>. I agreed with and still agree with Raymond's opening message in Feb 2015:<br>
"In teaching Python, I find that many Windows users are command-line challenged and have difficulties using and accessing PIP. ... I would love to be able to start a class with a fresh Python download from <a href="http://python.org" target="_blank">python.org</a> and effortlessly install requests and other tools without users having to fire-up a terminal window and wrestle with the various parts."<br>
<br>
The one change I made in Raymond's proposal is that instead of having multiple IDLE menu entries tied to multiple IDLE functions invoking multiple pip functions, there would be one IDLE menu entry, perhaps 'Help => Install packages' (plural intentional), that would invoke a standalone tkinter based gui front-end to pip. 'Standalone' means no dependency on IDLE code. I don't think every IDE or app should *have to* write its own gui. Plus, a standalone tkinter module could be invoked from a command line with 'python -m pipgui' or invoked from interactive python with 'import pipgui; pipgui.main()'.<br>
<br>
In April 2016, after posting the idea to pydev list and getting 'go ahead's from Nick Coughlin and someone else, with no negatives, I approved Upendra Kumar's GSOC proposal to write a pip gui. This was <a href="https://bugs.python.org/issue27051" target="_blank">https://bugs.python.org/issue2<wbr>7051</a>. On June 20, Ned Deily and Nick Coughlin vetoed adding a pip gui anywhere in the stdlib since it depended on something not in the stdlib, and perhaps for other reasons I don't fully understand.<br>
<br>
Looking back, I can see that I made two mistakes.<br>
<br>
The first was proposing to use the public-looking pip.main after importing pip. It is actually intended to be private (and should have been named '_main' to make that clearer). As it turns out, the extra work of accessing pip through the intended command line interface (via<br>
subprocess) is necessary anyway since running pip makes changes to the in-memory modules that are not reset when .main is called again. So it might as well be used for every access.<br>
<br>
The second was not requiring an approved PEP before proceeding to actual coding.<br>
<br>
-- <br>
Terry Jan Reedy<br>
<br>
______________________________<wbr>_________________<br>
Python-ideas mailing list<br>
<a>Python-ideas@python.org</a><br>
<a href="https://mail.python.org/mailman/listinfo/python-ideas" target="_blank">https://mail.python.org/mailma<wbr>n/listinfo/python-ideas</a><br>
Code of Conduct: <a href="http://python.org/psf/codeofconduct/" target="_blank">http://python.org/psf/codeofco<wbr>nduct/</a><br>
</blockquote></div>
</blockquote>
</blockquote></div>