Path: csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!news.dns-netz.com!news.freedyn.net!aioe.org!bofh.it!news.nic.it!robomod From: Jeremy Stanley Newsgroups: linux.debian.maint.python Subject: Re: How to watch pypi.org Date: Sat, 31 Oct 2020 18:40:02 +0100 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Sat Oct 31 17:37:45 2020 Old-Return-Path: X-Amavis-Spam-Status: No, score=-12 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -4.6 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="wufrw4vgxxai622v" Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) X-Sa-Exim-Connect-IP: 2001:4802:7801:102:be76:4eff:fe20:63e0 X-Sa-Exim-Rcpt-To: debian-python@lists.debian.org X-Sa-Exim-Mail-From: fungi@yuggoth.org X-Sa-Exim-Scanned: No (on azathoth.yuggoth.org); SAEximRunCond expanded to false X-Mailing-List: archive/latest/18757 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/20201031173727.buvq5kog733fldqd@yuggoth.org Approved: robomod@news.nic.it Lines: 68 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 31 Oct 2020 17:37:27 +0000 X-Original-Message-ID: <20201031173727.buvq5kog733fldqd@yuggoth.org> X-Original-References: <20201031144829.GA2261@belkar.wrar.name> Xref: csiph.com linux.debian.maint.python:12993 --wufrw4vgxxai622v Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2020-10-31 19:48:29 +0500 (+0500), Andrey Rahmatullin wrote: > On Sat, Oct 31, 2020 at 12:03:50PM +0100, Thomas Goirand wrote: > > Pypi is often thought as a Python module source repository. It > > is *NOT*. It is a repository for binaries to be consumed by pip. >=20 > Oooh, that's a very interesting thought I never considered. It's not entirely accurate, however. These days there are two remaining package formats commonly distributed through PyPI: sdists and wheels. The sdist format is intended to be a platform-independent "source distribution" (hence its name), perhaps more analogous to Debian's own source package formats, and the traditional setup.py in many sdists is akin to debian/rules and the $PACKAGE.egg-info/ tree similar to other sorts of metadata you would expect under the debian/ directory. Python package installation tools like pip call libraries to do things like compile and link included C extensions from the unpacked sdist before installing the results into a usable location in the system (or more recently, putting the results into a wheel package, then caching that and installing its contents into the system). When it comes to "binaries" this is definitely the domain of wheels. A wheel is (usually, with the exception of toolchains like flit) built from an sdist and may be platform-dependent, especially if it contains compiled extensions. The wheel is much more akin to Debian's binary package format. The main operating system distribution package maintainer argument against relying on sdists is that they may omit files from the upstream revision control system which that upstream did not want included in their official source distributions, or may include extra generated files which upstream did want included but don't exist (or at least don't exist as files in that form) within the upstream revision control. This is perhaps not entirely dissimilar =66rom C/autotools based projects having a `make dist` target which they use to prepare their source distribution tarballs. Whether it actually represents a problem for downstream packaging likely varies a bit from project to project. --=20 Jeremy Stanley --wufrw4vgxxai622v Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEl65Jb8At7J/DU7LnSPmWEUNJWCkFAl+doNEACgkQSPmWEUNJ WCkZBBAAu1+Bb2/K4VfVT2jHGMac2lamyy/rPjp6UB9yGhRLwFIFF8hGlcgk69l7 +80gxCKGH385lno0vuzAjS6kMjG+dfduoTS2on2Q/A5H00ScOB9W+Qr8NV4Ou5uA DdzYz560vX13O+E8J4Zrw/nKycUXxNdRWjUH0LMcCZ4qhAzTrCLQwjrfDsyT/r7u NoNze+E3GZtKJ+3Eo0eN8Gi7aA71RaeSEUMviFCxpFleLVrBvaHGC+zu8VF8BCGI zAJXnhCke4qhYgkbp4HPRTkDn7lEsMDL+bCdTBWXxb9jcCwfpySxIIXhJDyHZHtU Nu/MPkyHiLmgj0BAgFVhThAO3dcT9Ps6V/FXG4PGfltb07eAddiBseVOhvod5EQt apehyLN6IaaWccADQs5R9YvQclOGRnCnBkyST0j20ReRL7/Mu1xYGhQ0HBOjZfr8 ZVWzb69mvxkFX2Z7WVpDc8Hqaa4Aw/Z/p1eb5S2xXii1rEJGwzBCNW+QUQjVSMy3 S4Y/jcQ0eV07PwERbrvjteCy6+rJAs1APuUEmCEmSK02s8tHedN4JOqnT5U3/NZP L9Azt6sUpRI9AWRzovxzBYXhK8kqbAmb7qXWYcd0teDOFQvswgX/IEtt8lUgddVp 9TanC0cLo/0YRFY3pDXv5/uixJ+uKT3hjNLYPVPJV3dehL0Ce40= =5i6s -----END PGP SIGNATURE----- --wufrw4vgxxai622v--