Can I Use Just Wheels?
Are you worried about supply chain risks? You should be. Any clown can highjack a pypi package and replace with a malicious package that can run malicious code on:
- install pip/setup.py *
- import
- invocation
Can't do anything about import and invocation, but it is unnecessary to run setup.py, just always install wheels, using the following switches.
export PIP_ONLY_BINARY=:all:
pipenv install termcolor --skip-lock
# or
pip install termcolor --only-binary=:all:
But now you need to find out one by one, what in your requirements.txt doesn't support wheels!
Fortunately, here is a tool, based on the guts of caniusepython3.
Installation
pip install caniuseonlywheels --only-binary=:all:
Usage
pip freeze>requirements.txt
python -m caniuseonlywheels -r requirements.txt --verbose
Credits
Forked from "caniusepython3", Apache License, Original developer - Brett Cannon.
1 maintainer
Metadata
1 maintainer
Release files for caniuseonlywheels 1.0.11
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| caniuseonlywheels-1.0.11-py3-none-any.whl | Python 3 | none | any | Details |
Release files / caniuseonlywheels-1.0.11-py3-none-any.whl
| Download URL | caniuseonlywheels-1.0.11-py3-none-any.whl |
|---|---|
| Size | 512.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d8f64f8f40e4d680c58f78a5de8fe4dbeb20e1387b3aa685c9536878c8ee566c
|
|
BLAKE2b-256 checksum How to use checksums |
8603c1051b8d5b91ea8def5f9bd02fd4c4b069aefdaf9816104d298a72831f51
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.6.0 importlib_metadata/4.8.1 pkginfo/1.7.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.2 CPython/3.8.7
|
