Hacker News Reader

Comment by DangitBobby | Hacker News Reader

I need to publish it publicly to install it via pip, npm, cargo, etc. for public use.

Pip does not need a package to be public in order to install it at all, I’ve installed plenty of packages from tarballs and directories just fine. From the docs[0]

Install packages from:

- PyPI (and other indexes) using requirement specifiers.

- VCS project urls.

- Local project directories.

- Local or remote source archives.

Although I’m not quite sure how you’re using “for public use” in that sentence.

[0] https://pip.pypa.io/en/stable/reference/pip_install/#id19

I meant to say private use, not public use. But if I want to install from pip over the internet, which is my most common use case it needs to be publicly accessible, right? Which for me means GitHub, bitbucket, pypi, or some other bespoke solution just to avoid "publishing" something for my own private use. Or do I misunderstand?

You can publish to a local instance of PyPi

https://www.linode.com/docs/applications/project-management/...

I could do lots of things that would be unnecessarily burdensome for the dubious benefit of having my package unpublished. If it's acceptable to install it on a local network I can just do it directly from a normal filesystem.

GitHub and Bitbucket have private repositories and you can install from those using pip. There's nothing forcing you to make something public.

I know about private repos. The hangup was installing from them. Last time I looked up how to have private python packages the the impression I got was "It's not possible." But now with a single Google search I see that it's very much possible (by using ssh). Not sure what changed other than two years have gone by.

This is why I really liked the approach of using a github username as a namespace for rubygems, it lets you publish things but with some indication that it may just be for personal use.

I like that a lot! could work for personal python packages too.

You can install directly from GitHub, bitbucket, etc. with pip, BTW. My point was that if I want to have packages for private use installable over the internet with package management tools for various languages, I have to put them on the public internet, or jump through some hoops.

Package management tools for both Rust and Go and JS do support direct github urls with minimal boilerplate. You have no reason to make something public unless you want to.

Oh you can use those tools with private repos?

You can for sure with go

You can with Rust as well.

Using pip, and possibly other tools, you can try using a .netrc[0] file to manage login credentials for private repositories. Although it is a cleartext file (so you may need to manage access to it, for instance when using it in CI), at least your credentials will not show up in log files.

[0] https://www.gnu.org/software/inetutils/manual/html_node/The-...

Totally, I already do that. Would be interesting to be able to install sgillen.package separately from package, with just a flag passed to pip.

I'm not sure having a hard dependency on github is a good idea, I think approaches like that are giving github/microsoft too much power.

Installing from a generic git URL tends to work just fine, even if it's a bit more typing.

Yeah the useful thing is namespaces, I agree it would be good to not tie it to any given platform. I remember the cargo (rust) folks discussed including some way to have a namespace. I don't remember the details but I was disappointed they decided not to go that route.

I like this a lot. Publishing open source libraries and using them in private projects is a form of dogfooding.

Reply on news.ycombinator.com