Skip to main content

Can I switch to installing only using wheels and never sdist?

Project description

Can I Use Just Wheels?

Are you worried about supply chain risks? You should be. Any clown can highjack a pypi package and replace with a malicious package that can run malicious code on:

  • install pip/setup.py *
  • import
  • invocation

Can't do anything about import and invocation, but it is unnecessary to run setup.py, just always install wheels, using the following switches.

export PIP_ONLY_BINARY=:all:
pipenv install termcolor --skip-lock
# or
pip install termcolor --only-binary=:all:

But now you need to find out one by one, what in your requirements.txt doesn't support wheels!

Fortunately, here is a tool, based on the guts of caniusepython3.

Installation

pip install caniuseonlywheels  --only-binary=:all:

Usage

pip freeze>requirements.txt
python -m caniuseonlywheels -r requirements.txt --verbose

Credits

Forked from "caniusepython3", Apache License, Original developer - Brett Cannon.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distribution

caniuseonlywheels-1.0.11-py3-none-any.whl (512.6 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page