I think the Java/Go/Rust model where all dependencies are included in the binary is the way to go.
But here we have exactly the kind of project that should be written in Python, forked and cloned by you, then tweaked and maintained as if you wrote it yourself. From a brief glance through the code, and taking the submission title at face value, this project is a refreshingly appropriate use of the right language. I offer this as someone who writes Python and Go, generally preferring Go anywhere possible.
I plan to poke around some more in this repo to see if I can easily replace my use of Hugo with this, since I use only a tiny fraction of the features in Hugo and have found it challenging to hack on it as a low-priority weekend project.
For turning personal blog posts from markdown to HTML with some general convenience functions around maintaining the front-matter and templates, I can’t think of something more appropriate than a Python script sitting inside your blog directory with all of its dependencies except the interpreter itself checked in with your templates and content.
It was such a mess that I can't even describe the frustration. And I even got Apache working with SVN! (40 pages of docs and no testing points from start till it's fully working, yuck)
EDIT: Since I got downvotes so quick, tell me why anyone should choose Python over the many alternative out now?
Since I am not a Python dev, I would be unable to provide a useful report even if it were bugs.
For example, this "simple, lightweight" program has dependencies, as one can see in its .travis.yaml file. That's why the readme has the command `pip install commonmark` (plus more dependencies for dev). But, wait, doesn't `pip` install as root in /usr/local/ by default? (BTW, the documentation of `pip install` is mute on the subject.) So I should use pipenv, but last time I tried it was broken and the ticket had low activity. So virtualenv + pip, but it's a mess since I like using many terminals. I've heard about poetry, but that's not standard at all...
apt install python3 virtualenv
virtualenv env
. env/bin/activate
pip install -r requirements.txt
The happy case works, it always does. The problem is in the edge cases and the exceptions. This probably goes for the bulk of all software.
I strongly agree that any python program must install its dependencies in a virtualenv. One could even argue that this principle could be extended to any software !
Just pip install to the location you choose. sudo or —user is fine 99% of the time. Venvs are only needed for big work projects.
Virtualenv is usually excessive unless you have to handle lots of version problems
It’s actually not as bad as I thought it would be. I modified one of the twenty-x themes that come with it and installed a few plugins to make a decent personal site. It took less time that it would have to create anything with remotely similar functionality.
I run it off a single vps that has no other purpose. If it gets hacked, nothing of value is lost. I can revoke the api keys for the external services I use and restore to a new server from my backups.
For example, making sure that software cannot modify itself will ensure that even if server is vulnerable, it won’t get permanently compromised. Having a server that does not execute any file with right extension makes sure that sanitization errors do not lead to code execution. Having admin system be separate from main site makes sure XSS cannot cause compromises.
adding the "ipgeoblock plugin" wipes out most attacks straight away.
with some of my wp sites that got attacked a lot on a regular basis, I use a 'static html generator' plugin - and delete all the wp php files -
no way to login, add comments or hack the wp core or plugins or themes, since they are not in use when you convert it all the static html.
On wp sites where I actually add content with regularity, I don't delete the wp files, and just use shield, sucuri, ipgeoblock, plugin things like that depending on threat.
Six security vulnerabilities in core WP just last month.
It's still a mess, and every plugin gives it a bigger attack surface.
This is how triple scripts are designed[1] to work.
One proof-of-concept just so happens to be a minimalist static site generator called triickl[2]. You can drop it onto (virtually) any machine, double click, and point it at a source directory for your site—subject to the expectation that it follows a certain jekyll-like structure—and then you're off to the races. I'm using it as the build step for the triplescripts.org home page itself and my personal site.
I've used it in multistage Docker builds to produce very clean, minimal production images like what people commonly do in Go.
gulp build
Error: cannot find dependency 'left pad.js'