Can I switch to installing only using wheels and never sdist?
Project description
Can I Use Just Wheels?
Are you worried about supply chain risks? You should be. Any clown can highjack a pypi package and replace with a malicious package that can run malicious code on:
- install pip/setup.py *
- import
- invocation
Can't do anything about import and invocation, but it is unnecessary to run setup.py, just always install wheels, using the following switches.
export PIP_ONLY_BINARY=:all:
pipenv install termcolor --skip-lock
# or
pip install termcolor --only-binary=:all:
But now you need to find out one by one, what in your requirements.txt doesn't support wheels!
Fortunately, here is a tool, based on the guts of caniusepython3.
Installation
pip install caniuseonlywheels --only-binary=:all:
Usage
pip freeze>requirements.txt
python -m caniuseonlywheels -r requirements.txt --verbose
Credits
Forked from "caniusepython3", Apache License, Original developer - Brett Cannon.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distributions
No source distribution files available for this release.See tutorial on generating distribution archives.
Built Distribution
Close
Hashes for caniuseonlywheels-1.0.11-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | d8f64f8f40e4d680c58f78a5de8fe4dbeb20e1387b3aa685c9536878c8ee566c |
|
MD5 | f45782eee0db73ba4cd994c86b1777fc |
|
BLAKE2b-256 | 8603c1051b8d5b91ea8def5f9bd02fd4c4b069aefdaf9816104d298a72831f51 |