On 15 February 2017 at 15:58, Paul Moore <p.f.mo...@gmail.com> wrote: > On 15 February 2017 at 14:11, Nathaniel Smith <n...@pobox.com> wrote: >>> It's mainly a matter of incorporating >>> https://caremad.io/posts/2013/07/setup-vs-requirement/ into the core >>> data model, as this distinction between abstract development >>> dependencies and concrete deployment dependencies is incredibly >>> important for any scenario that involves >>> publisher-redistributor-consumer chains, but is entirely non-obvious >>> to folks that are only familiar with the publisher-consumer case that >>> comes up during development-for-personal-and-open-source-use. >> >> Maybe I'm just being dense but, umm. I don't know what any of these >> words mean :-). I'm not unfamiliar with redistributors; part of my >> confusion is that this is a concept that AFAIK distro package systems >> don't have. Maybe it would help if you have a concrete example of a >> scenario where they would benefit from having this distinction? > > I'm also finding this discussion bafflingly complex. I understand that > distributions need a way to work with Python packages, but the issues > involved seem completely divorced from the basic process of a user > using pip to install a package with the dependencies it needs to work > in their program.
As simple as I can make it: * pinning dependencies when publishing to PyPI is presumptively bad * PyPI itself (not client tools) should warn you that it's a bad idea * however, there are legitimate use cases for pinning in PyPI packages * so there should be a way to do it, but it should involve telling PyPI "I am an integration project, this is OK" Most people should never touch the "integrates" field, they should just change "==" to "~=" or ">=" to allow for future releases of their dependencies. Cheers, Nick. -- Nick Coghlan | ncogh...@gmail.com | Brisbane, Australia _______________________________________________ Distutils-SIG maillist - Distutils-SIG@python.org https://mail.python.org/mailman/listinfo/distutils-sig
