Skip to main content

Edits your requirements.txt by peep-hashing them

Project description



``peep`` is basically over. The functionality of ``peep`` was folded
into ``pip`` directly. So basically, there's no need to use ``peep``
any more.

This is therefore true for ``peepin`` too.

**You should use "hashin": instead.**

``hashin`` is compatible with ``pip>=8.0``.


.. image::

This tool makes it easier to update your strict "peep-ready"
``requirements.txt`` file.

If you want to add a package or edit the version of one you're currently
using you have to do the following steps:

1. Go to pypi for that package
2. Download the .tgz file
3. Possibly download the .whl file
4. Run `peep hash downloadedpackage-1.2.3.tgz`
5. Run `peep hash downloadedpackage-1.2.3.whl`
6. Edit requirements.txt

This script does all those things.
Hackishly wonderfully so.

A Word of Warning!

The whole point of peep is that you vet the packages that you use
on your laptop and that they haven't been tampered with. Then you
can confidently install them on a server.

This tool downloads from PyPI (over HTTPS) and runs ``peep hash``
on the downloaded files.

You still need to check that the packages that are downloaded
are sane.

You might not have time to go through the lines one by one
but you should be aware that the vetting process is your


This is something you only do or ever need in a development
environment. Ie. your laptop::

pip install peepin

How to use it

Suppose you want to install ``futures``. You can either do this::

peepin futures

Which will download the latest version tarball (and wheel) and
calculate their peep hash and edit your ``requirements.txt`` file.

Or you can be specific about exactly which version you want::

peepin "futures==2.1.3"

Suppose you don't have a ``requirements.txt`` right there in the same
directory you can do this::

peepin "futures==2.1.3" stuff/requirementst/prod.txt

If there's not output. It worked. Check how it edited your
requirements files.

Runnings tests

Simply run:

python test


To avoid having to install `peepin` just to test it or debug a feature
you can simply just run it like this:

touch /tmp/whatever.txt
python --verbose Django /tmp/whatever.txt

Ode to Erik Rose

Just in case you didn't know;
`peep <>`_ is awesome.
It makes it possible to confidently leave
third-party packages to be installed on the server without needing to
be checked into some sort of "vendor" directory.

Having said that, if you don't care about security or repeatability.
Then Erik is just a dude with a goatee.

Version History

* Loud warning if you try to use ``peepin`` when you have ``pip>=8``

* Important bug fix that prevented you from installing specific
version. Thanks @pmclanahan

* Started using the JSON interface of pypi instead of scraping the

* Bugfix so that it doesn't just insert the new SHAs but also the new
package name and version.

* Replaced all HTTP mocking done by `httpretty` with regular `mock`.

* If you had lines like `` in
the requirements the editing of lines got confused.

* installs argparse if you're on python 2.6

* Avoid editing the requirements file if no packages are found, fixed #3

* Ability to download binary URLs

* Works in python 2.6, 2.7, 3.3 and 3.4

* Fix for multi-version packages like Django

* Be verbose about downloaded files

* Regression

* --verbose option

* Works

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
peepin-0.14-py2-none-any.whl (7.9 kB) Copy SHA256 hash SHA256 Wheel py2 Jan 26, 2016
peepin-0.14-py3-none-any.whl (7.9 kB) Copy SHA256 hash SHA256 Wheel py3 Jan 26, 2016

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page