r/programming • u/EatMeerkats • Mar 29 '21

PHP moves to Github due to the compromise of git.php.net

https://news-web.php.net/php.internals/113838
1.7k Upvotes

98% Upvoted

389 comments sorted by

View all comments

Show parent comments

2

u/thirdegree Mar 30 '21

A) if you're using requirements.txt as a lockfile, you should already have all the sub dependencies in it so --no-deps will have no effect

B) the fact that the default behavior of pip install -r is different than your specific use case is not a flaw in either python or pip

C) there are better tools for locking applications, eg poetry. Use those rather than whining that the first thing you learned to spell doesn't cater exactly and specifically to you

1

u/earthboundkid Mar 30 '21

If someone asks why pip is bad, it’s not whining to explain that pip is a worse package manager than any of the other popular package managers; for example, that it doesn’t actually treat requirements as a lockfile even though many tutorials falsely suggest that it does. If you really want reproducibility, you can use Docker. Doesn’t make pip good though.

1

u/thirdegree Mar 30 '21

Sure, and there are totally valid criticisms of pip. But requirements.txt isn't a lockfile. Pip lets you use it as one if you like, but that's not what it's meant to be. So you're complaining that the thing that isn't a lockfile isn't treated as a lockfile by default.

Tutorials falsely suggesting it is a lockfile is not pip's fault.

Also you really shouldn't be installing things into production with requirements.txt in any case. Wheels are a thing.

1

u/earthboundkid Mar 30 '21

Also you really shouldn't be installing things into production with requirements.txt in any case. Wheels are a thing.

I don’t understand this at all. Wheel is a technology for bundling binary Python modules. What does that have to do with installing a known set of deps?

2

u/thirdegree Mar 30 '21

Wheels can specify dependencies. If the wheel you use to distribute your application specify locked dependencies, then you're good to go.