Clean up packaging and build system #17
Conversation
|
Thanks for the changes. I'd prefer to keep the frozen requirements, though, at least somewhere in the tree. I consider it unfortunate that frozen dependencies/lockfiles aren't as common in Python as they are in Rust/Go/JS/etc. I don't think keeping it should cause significant issues—someone has to be pretty deliberate in their decision to install the frozen dependencies; any other installation method will resolve the dependencies in the normal Python way. But maybe I'm missing something. |
It is identical to the install_requires so it is not needed. See-also: https://packaging.python.org/discussions/install-requires-vs-requirements/
Leave stub setup.py for compatibility and for computed long description. Spacing added to requirements for readability, but the sdist is identical as the spaces are auto-stripped by setuptools when building the sdist. See-also: https://packaging.python.org/guides/distributing-packages-using-setuptools/
|
Updated the PR to drop the frozen requirements removal.
I'm not familiar with when frozen requirements are used,
so I'm happy to defer to you on this decision.
Frozen requirements are not something I would ever use,
I always want to use either an old but security supported version
or the very latest version after testing it thoroughly.
…--
bye,
pabs
https://bonedaddy.net/pabs3/
|
|
The main benefit of frozen/locked dependencies is build reproducibility and predictability (since a new version of a dependency that should work the same may not), and the dependencies shouldn't generally need to be updated, but security issues always pop up, of course. The dependencies should be updated in that case; I just don't always have the time to check/fix that. I think most or all of the programming languages I listed whose build systems have better support for this also make it easier to deal with security vulnerabilities in locked/frozen dependencies (e.g., by warning users who install the package or automatically bumping it up to the next secure version). Unfortunately, Python doesn't have great support for this. |
No description provided.