Hacker News Reader

Comment by SmirkingRevenge | Hacker News Reader

After years of python dev professionally, I just quit worrying about it, and embraced:

- vanilla virtualenv: I don't even bother with the wrapper most of the time.

- vanilla setup.py/setup.cfg: Its just really not that bad. Forget about project.toml or whatever the next big thing is.

- pip-tools: ditching pipenv and using this for pinning app requirements, has made my life so much simpler.

View on HN

Most of the time I just stick with this in a .envrc file:

  export VIRTUAL_ENV=${XDG_CACHE_HOME:-~/.cache}/virtualenvs/$(basename $PWD)
  export PATH="${VIRTUAL_ENV}/bin:$PATH"
  python3 -m venv $VIRTUAL_ENV

I just enter the directory and the environment is created/'activated'.

In all the years I never had any need to use the real activate method. Just running Python and scripts directory from the bin/ in the virtualenv is enough to run 'inside the env'.

When I get the choice I use Nix and ignore as much of the "python" packaging infrastructure as possible - it's all a vague and unreliable toy compared to a real package manager. It all particularly falls apart when it comes to non-python dependencies.

`pip-tools` has served me well, but an annoying gripe that pipenv/Poetry resolves is that you can't install git links in non-editable mode, i.e.

   -e git+https://github.com/...

Works, but

   git+https://github.com/...

Doesn't.

Also can you pin your dependencies to a specific hash? Last I checked you cannot. A major advantage of pipenv/Poetry is that the lockfile protects you against compromise of the package manager; if someone swaps in a new binary for yourdep==1.2.3, the lockfile will fail to validate the hash and you'll get an error.

pip-compile added support for pinning hashes in 1.8.0 (in 2016) and support for non-editable URL dependencies in 3.7.0 (in May).

Did you try the http link to source tarball instead of git url ?

Same. Plus script to automatically freeze dependencies into requirements.txt after each `pip install/update/uninstall`.

I've never moved from it. I never got the point of any other dependency management tool.

The one large problem of those are forgetting about activating a venv, so I get I'll spend some time learning how to use direnv from aequitas advice.

Reply on news.ycombinator.com