Better Package Management for python
nvie.com
nvie.com
In this case I don't think either tool is needed - pip-sync is really trying to avoid tearing down and rebuilding cleanly a virtual env - which is the whole point of virtual environments anyway.
Anyway - yes we need to fix python package management. No there is not a clear solution. But then apt-get, Tuesday updates and gems don't work "right" either.
Right at this moment, with Docker coming to the fore, it's easy to imagine a world where it doesn't matter anymore.
Even small projects get cluttered requirements.txt files very fast, causing unneeded packages to spread like viruses from venv to venv, requiring coordination from the whole team to definitely eradicate, because one member's sloppy hygiene spreads the contagion back to everyone.
I don't know if pip-compile is the right answer to that problem, but it certainly seems to go in the right direction, providing living documentation of your direct requirements in the requirements.in file.
IMHO we'd first need to standardize how dependencies are managed (requirements.txt, setup.py ...)and then build a solution off that. if you have requirements.txt-based setup, is easy to e.g. recursively download/parse to get the full list of dependencies.
The requirements.in file reminds me of automake.
I don't really like the idea of consolidating dependencies locally because you'll end up with a big compiled requirements.txt which then you have to maintain yourself. IMHO it'll be a drag when you'll update a 3rd party dependency which has its own changed dependencies...
I don't really see how it's much different from Gemfile.lock for Ruby or npm-shrinkwrap.json for Node.
I'm not really against of tracking dependencies recursively, but not for the final purpose of building a grand requirements file (which people will end up using and tweaking). I'm more interested if there are conflicts between different 3rd party libs (e.g. if one needs package==1.0.0 and the other needs package=1.2.0) and if they're not necessarily backwards compatible (e.g. v1.4 vs v1.6 of django).
Now, if you want to change the version of a 3rd party which, in turn, has altered dependencies, you'd need to clean up the venv anyway to be on the safe side. Currently I end up just rebuilding the venv and performing a pip install. On distribution, you could build an equivalent of a gemfile.lock via pip freeze (again). Hence, no real benefit of a pip-compile. Still, a pip diff (e.g. between 2 requirements.txt, tracking recursively dependencies) would be of more value imho, particularly if the devs would agree on a pattern/best practice.
There's also the matter of adding yet another file (requirements.in) to the setup framework (setup.py, metafiles...) and somewhat changing the meaning of requirements.txt.
I guess what you're suggesting is that requirements.txt should be the equivalent of a Gemfile and there should be a separate "requirements.lock" (or whatever) which tracks the output of pip freeze.
On top of that, I understand that you're suggesting that the generation of this lock file should be part of the process of setting up a virtualenv as opposed to a separate tool such as pip-compile.
If my interpretation is correct, then I totally agree. Although I still think pip-compile may be useful until such a tool exists :)
If I install an app/package for development, then I'd need development dependencies (like test-related packages etc.). I'm not supposed to know/care what the third party code needs for testing; just when I start testing the relevant code should "just work". Also, if I'm in production the testing-related packages should not pollute my environment...
I'd love to see Pip, Bundler/Rubygems, NPM, Cabal, Maven, etc. replaced by a single tool (or maybe two: dependency management and package installation).
To be more exact, how many times have you customised your setup.py file? edited its dependencies and so on..? Imagine doing that in a totally different system (like debian packaging).
You can even now manage your dependencies and install scripts with something like automake or a homemade solution. Not really portable but if you don't care about your code being a module part of a bigger system...
(Maybe I need to read the entire virtualenv documentation, to have a solid idea of how it works, and what it does exactly, but hen that will take time, and the PYTHONPATH option starts to look more appealing, as at least I do know how environmental variables work in Linux).