Re: Suggestion: PEP for tracking vulnerable packages within PyPI

2015-05-12 Thread Mark Lawrence
On 12/05/2015 22:56, Grant Murphy wrote: Please don't top post here it's extremely irritating. -- My fellow Pythonistas, ask not what our language can do for you, ask what you can do for our language. Mark Lawrence -- https://mail.python.org/mailman/listinfo/python-list

Re: Suggestion: PEP for tracking vulnerable packages within PyPI

2015-05-12 Thread Grant Murphy
Ok so.. no PEP needed then..alright then... my plan now goes something like this: 0. Send this email. 1. Unsubscribe from the python-list. (I don't enjoy the company of trolls). 2. Actually fix the problem and submit a PR. 3. Go have a beer. Apologies for the multiple emails. I can see how Mark

Re: Suggestion: PEP for tracking vulnerable packages within PyPI

2015-05-12 Thread Tim Golden
On 12/05/2015 22:17, Mark Lawrence wrote: On 12/05/2015 20:46, Grant Murphy wrote: Hi, When pulling in a dependency via pip it is currently difficult to reason about whether there are any vulnerabilities associated with the package version you are using. I think the Python package management

Re: Suggestion: PEP for tracking vulnerable packages within PyPI

2015-05-12 Thread Mark Lawrence
On 12/05/2015 20:46, Grant Murphy wrote: Hi, When pulling in a dependency via pip it is currently difficult to reason about whether there are any vulnerabilities associated with the package version you are using. I think the Python package management infrastructure could be extended to facilitat

Suggestion: PEP for tracking vulnerable packages within PyPI

2015-05-12 Thread Grant Murphy
Hi, When pulling in a dependency via pip it is currently difficult to reason about whether there are any vulnerabilities associated with the package version you are using. I think the Python package management infrastructure could be extended to facilitate this capability reasonably easily. PyPI a