Menu
Super newb question here..
What does pip install actually do?
Assuming the pypi package is a tarball...
Does it just download the tar.gz, unpack it and run setup.py?
Does it add the downloaded package to the site_packages folder?
I want to create a pip installable pkg using pypiserver so my colleagues can download my pkg in a painless way, but am a little unsure exactly what to include beyond the actual .py scripts.
Any guidance would be appreciated
796
To summarize, yes, a few instances of malware being present in the library have been detected. More to the point, there is no protection against malware other than the user's own diligence. IMHO meaning that there is no way a user can be absolutely assured of the security of the software they are using.
They do exactly the same thing. In fact, the docs for distributing Python modules were just updated to suggest using python -m pip instead of the pip executable, because it's easier to tell which version of python is going to be used to actually run pip that way.
Usually, pip is automatically installed if you are: working in a virtual environment. using Python downloaded from python.org. using Python that has not been modified by a redistributor to remove ensurepip.
Outside of a Python virtual environment it really is best to avoid using pip install without the --user entirely. This would install Python packages in places that really should be left to the system's package manager (for example apt in Debian/Ubuntu).
The tar.gz file is a source archive whereas the .whl file is a built distribution. Newer pip versions preferentially install built distributions, but will fall back to source archives if needed. You should always upload a source archive and provide built archives for the platforms your project is compatible with. In this case, our example package is compatible with Python on any platform so only one built distribution is needed.
See: https://packaging.python.org/tutorials/packaging-projects/
You would typically not manually create the source archive and wheel, but use setuptools and wheel to do so for you.
Nowadays, many packages are wheels. While installing these wheels using pip, pip will:
[...] unpack the archive in your current site packages directory and install any console scripts contained in the wheel.
See: https://wheel.readthedocs.io/en/stable/user_guide.html#installing-wheels
190
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
