pip freezing (==) isn't safe (intermediate) anthony explains #455

today I walk through why == pinning isn't enough to ensure repeatability through an *intentional* feature. personally, I hope this "feature" gets removed

==========

I won't ask for subscriptions / likes / comments in videos but it really helps the channel. If you have any suggestions or things you'd like to see please comment below!

[thisfred]

This is one reason I like pip-tools: it adds the hashes to the requirements files, so they can be verified on install.

[con-f-use]

I was gonna say pipenv and poetry do locking using the checksums, might be a "solution" though has other problems part of which you mentioned. At least the lockfiles of those tools take into account, that users might need multiple wheels for the same version of a package (e.g. one v2.0.0 wheel for mac users, another for v.2.0.0 on linux, yet another one for windows, ...) and lock those with their checksums, too.

[madumlao]

Doesn't sound like a bug per se. From the name of the option itself, a "build number" would be the same version of the software, just possibly rebuilt with different options / settings and not justifying a version bump. I'd say if you fundamentally can't trust the source of your package at the level of package semantics, you have much bigger problems, and a requirements specifier isn't supposed to be used as a security tool to protect against that.

[atugushev]

All hail `pip-compile --generate-hashes`! ^___^ Thanks for the great topic! That's funny how easy to inject a malicious package into a private PyPI index server.

[johnflynn]

Another point for conda. “Conda env export” pins build hashes in addition the version. The whole python packaging ecosystem is such a mess and always has been. Conda is the only solution that makes it make sense in spite of PyPAs best efforts to keep it bad.

[lonterel]

Maybe its a bug in packaging.SpecifierSet? Because pip uses it internally, maybe its already fixed in main branch of packaging repo, but there is no release

[dumbqs]

Anthony how do you implement hash validation?

[ChristianBrugger]

Isn't it still that packages can be overwritten on PyPI? By removing and re-uploading it under the same name. Or has this been changed?

[amir.hessam]

I like poetry export without hashes but idk if it solves the problem you mentioned here; gotta check it out

[dhruvakashyap]

Wait, this sounds like some sort of society crumbling bug waiting to explode, right?

[alexprengere]

So it would be nice to have an option to "pip freeze" to include the build numbers?

[-morrow]

pip/pypi is a security nightmare. it's worse than npm, just was lucky enough to not get the headlines.

[soberhippie]

You can also download all your required wheels and keep them in your git repo along with the project, and use pip install