Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Philippe Cerfon Newsgroups: linux.debian.maint.python Subject: can pip be made using local Debian packages for any dependencies Date: Sun, 12 Feb 2023 06:00:02 +0100 Message-ID: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Feb 12 04:56:30 2023 Old-Return-Path: X-Amavis-Spam-Status: No, score=-2.199 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-pg1-x529.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AO0yUKXNRCbiVYCD+kEw29ZRYwh03LOm3FKIkS6YW8ORHxxZjj0fM9VD xT2/s/j/JECTk20iCK0Bw7AJfn4F/PLcgBQmQs9dVyn2 X-Google-SMTP-Source: AK7set/EDXTSnPtSHVCaKRhluUmD2g/kmL70AiiVGAQCtDMMABQgw0uVvv9rhahhzWRwNHEZI8TrdOL1eZYQ1rf9L9M= X-Received: by 2002:aa7:9466:0:b0:58b:957a:5ec7 with SMTP id t6-20020aa79466000000b0058b957a5ec7mr4060629pfq.39.1676176781988; Sat, 11 Feb 2023 20:39:41 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Mailing-List: archive/latest/20810 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAN+za=M3QvK2eb_OPoxYpCA2_gtejXDMcY0kH+U6s+x_hJomCg@mail.gmail.com Approved: robomod@news.nic.it Lines: 31 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sun, 12 Feb 2023 05:39:31 +0100 X-Original-Message-ID: Xref: csiph.com linux.debian.maint.python:14911 Hey. I hope this is not too off topic. As far as I understand, dh-python, when building packages somehow automatically uses the Debian package names and even prevents e.g. setuptools from downloading any dependencies by setting a (hopefully not running) proxy. I wondered whether it's possible to make tools like pip and setuptools directly use the Debian python packages when resolving dependencies. The main motivation are security constraints, so I had to configure pip so that it cannot just download packages from PyPI (which is rather easy, simply setting no-index in pip.conf). But then of course it also fails to e.g. do an editable install of a locally developed package, when it tries to resolve the dependencies. So I wondered whether it's possible to prevent pip from downloading any remote stuff, while still resolving dependencies (respectively consider them as being resolved) *if* the package is locally installed from the Debian archive? (If a dependency isn't installed from a package it may of course fail.) Thanks, Philippe. PS: Please keep me CCed.