Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Ian Norton Newsgroups: linux.debian.maint.python Subject: Re: can pip be made using local Debian packages for any dependencies Date: Sun, 12 Feb 2023 09:20:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Feb 12 08:13:00 2023 Old-Return-Path: X-Amavis-Spam-Status: No, score=-7.199 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-oi1-x22e.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AO0yUKWa/ov1zjr/kytmj9u1iA7Ddtx/HfpQAMTZGP3ykc8tTJ47JMyj LezJLChylieSzAqfGSCbPu5ibIEzH/BnejEIfiE= X-Google-SMTP-Source: AK7set/nnd3KyhlD3YfikPmMvZGYLuUr1TQOCf80T1Fu4jEVNkForyMMgGngQ76VZxEJgqBFTYxB4ESrJ8dpa9al+dw= X-Received: by 2002:aca:e141:0:b0:37a:ea8d:e093 with SMTP id y62-20020acae141000000b0037aea8de093mr1777706oig.281.1676189561697; Sun, 12 Feb 2023 00:12:41 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Mailing-List: archive/latest/20812 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAGUnuBGzeH3Uy8Fe6fJvoxsi9yCJXHvLYss4FKR+V+9XTut35Q@mail.gmail.com Approved: robomod@news.nic.it Lines: 43 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Sun, 12 Feb 2023 08:12:28 +0000 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.maint.python:14913 You've made me wonder if it would be feasible to have a debian-centric tool that populates .dist-info from debs? On Sun, 12 Feb 2023 at 08:05, Ian Norton wrote: > > I requested this kind of thing from the pip folks as > https://github.com/pypa/pip/issues/11644 and others have requested > similar, such as https://github.com/pypa/pip/issues/11607 > > On Sun, 12 Feb 2023 at 04:56, Philippe Cerfon wrote: > > > > Hey. > > > > I hope this is not too off topic. > > > > As far as I understand, dh-python, when building packages somehow > > automatically uses the Debian package names and even prevents e.g. > > setuptools from downloading any dependencies by setting a (hopefully > > not running) proxy. > > > > > > I wondered whether it's possible to make tools like pip and setuptools > > directly use the Debian python packages when resolving dependencies. > > > > The main motivation are security constraints, so I had to configure > > pip so that it cannot just download packages from PyPI (which is > > rather easy, simply setting no-index in pip.conf). > > > > But then of course it also fails to e.g. do an editable install of a > > locally developed package, when it tries to resolve the dependencies. > > > > So I wondered whether it's possible to prevent pip from downloading > > any remote stuff, while still resolving dependencies (respectively > > consider them as being resolved) *if* the package is locally installed > > from the Debian archive? > > (If a dependency isn't installed from a package it may of course fail.) > > > > > > Thanks, > > Philippe. > > > > PS: Please keep me CCed. > >