Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Philippe Cerfon Newsgroups: linux.debian.maint.python Subject: Re: can pip be made using local Debian packages for any dependencies Date: Mon, 13 Feb 2023 02:20:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Mon Feb 13 01:12:11 2023 Old-Return-Path: X-Amavis-Spam-Status: No, score=-2.199 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-pj1-x1036.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AO0yUKXLkvo5W6kg4T3MrO1eL58/wtGxZ7XGkbdv67OZ5H4EkSYcreSN s+nOo4Uq+1X+LhBDgPJ7naWRYFmY3Ww37OhymK8= X-Google-SMTP-Source: AK7set9++hYDFuBSFJtgReezrBEtTZrs4J8abL+RvBjSHlxmhBSCpagVGc61C1+jg14KB5W5FnrmACWLJXlf9g8H5z8= X-Received: by 2002:a17:902:8348:b0:193:794:ba9 with SMTP id z8-20020a170902834800b0019307940ba9mr5429479pln.22.1676249749133; Sun, 12 Feb 2023 16:55:49 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Mailing-List: archive/latest/20816 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAN+za=NHXNgysOxb2-ME8+mttne=fA6ATU+G79pAJYMSHDU5Zw@mail.gmail.com Approved: robomod@news.nic.it Lines: 22 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Mon, 13 Feb 2023 01:55:38 +0100 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.maint.python:14917 On Sun, Feb 12, 2023 at 9:05 AM Ian Norton wrote: > I requested this kind of thing from the pip folks as > https://github.com/pypa/pip/issues/11644 and others have requested > similar, such as https://github.com/pypa/pip/issues/11607 While they wrote it would be discussed, it doesn't really seem as if they would care too much or as if anything would have happened since then? :-( I cannot really comment too much about the rest you wrote, as I'm not really a Python or Debian packaging expert. What I'd like to have is "simply" ;-) to prevent installation of any remote code (as pip and similar tools, also for other languages, do) and still use them as far as I have the packages from Debian installed. So for example, even if the pyproject.toml would specify some version of a dependency that is not in Debian, it should rather fail than downloading anything from somewhere. Regards, Philippe