Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A non-magical introduction to pip and virtualenv for Python beginners

dabapps.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: A non-magical introduction to pip and virtualenv for Python beginners

#31

Post by toukon »

I'd like to know what the best practices with regards to security are for using pip, or installing packages in general.

How do you verify package integrity? Do you simply pray that PyPI isn't compromised at the moment, or do you download your packages from Github instead, because the main repositories have more eyeballs on them?

How do you do security updates with pip?

I'm using apt-get at the moment which gives me security updates AFAIK, but my need is growing for more recent versions and certain packages that aren't accessible with apt.

Re: A non-magical introduction to pip and virtualenv for Python beginners

#32

Post by pstuart »

JulianWasTaken wrote: post #15

> Python actually has another, more primitive, package manager called easy_install, which is installed automatically when you install Python itself. It's actually not, it's part of setuptools/distribute, though some Python distributions (actually just brew that I know of) include distribute alongside Python. Also, while the quick skim of the rest of this looks mostly good, there's some unnecessary advice which compli…

I recently learned the lesson about global packages. I thought it would be so nice to have all packages readily on hand, but now startup time is about 15 seconds of crawling the filesystem looking for files (over NFS).

Go is looking more attractive day by day.....

Re: A non-magical introduction to pip and virtualenv for Python beginners

#36

Post by phren0logy »

Nice article, but after using leiningen (the clojure solution to a similar problem, based on maven), it's really hard to go back to something like this. I really, really wish there was an equivalent in python (really, every language I use).

Re: A non-magical introduction to pip and virtualenv for Python beginners

#37

Post by Daiz »

Man, global system-wide installations that require admin rights by default? That's certainly something! Quite the stark comparison to Node.js and npm, where everything is installed locally into the current directory (under node_modules) by default, and "global" installation is actually a per-user installation. Tricking pip with virtualenv seems to get you pretty close to what you get by default with npm, albeit still somewhat more clunky. But to be fair, most other package managing solutions seem to pale in comparison to npm :-)

Either way, nice article. Now if only most packages weren't still for Python 2... PyPI says it has 30099 packages total, but only around 2104 of them are for Python 3 (according to the number of entries on the "Python 3 Packages"-page[1]).

[1] https://pypi.python.org/pypi?:action=browse&c=533&sh...

Re: A non-magical introduction to pip and virtualenv for Python beginners

#40

Post by metaphorm »

tocomment wrote: post #4

He mentions not checking the env directory into git. Why not? In general what are the best practices for using virtualenv with version control?

check in your requirements.txt file and run pip install -r requirements.txt on whichever machine you've just cloned the git repo to.
Post reply on HN