Menu
I am trying to use pip-tools to manage a venv (as in python -m venv .venv) environment. The freshly-activated environment has nothing but pip-tools initially:
> pip list
Package Version
--------- -------
Click 7.0
pip 19.3.1
pip-tools 4.2.0
six 1.13.0
I created a requirements/main.in file with just:
numpy
matplotlib
Running pip-compile --upgrade --build-isolation --generate-hashes --output-file requirements/main.txt requirements/main.in gives me this warning:
# WARNING: The following packages were not pinned, but pip requires them to be
# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag.
# setuptools==41.6.0 # via kiwisolver
The generated requirements file may be rejected by pip install. See # WARNING lines for details.
As warned, pip install --upgrade -r requirements/main.txt rejects the operation with:
ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
setuptools from https://files.pythonhosted.org/packages/d9/de/554b6310ac87c5b921bc45634b07b11394fe63bc4cb5176f5240addf18ab/setuptools-41.6.0-py2.py3-none-any.whl#sha256=3e8e8505e563631e7cb110d9ad82d135ee866b8146d5efe06e42be07a72db20a (from kiwisolver==1.1.0->-r requirements/main.txt (line 11))
So now my predicament is: should I use --allow-unsafe? What are the implications of doing this? I tried it and found that the generated requirements file has it pinned to that particular version, which kiwisolver (I guess a transitive dependency of numpy/matplotlib) needs right? But why is this unsafe?
If I understand it correctly, I can keep my generated requirements for as long as I want, but then - whenever I decide to update - I can re-run pip-compile and create a new requirements file will be fresh and it may have a new kiwisolver that does not have this restriction, right?
What is the reason pip-tools is asking ME to make this decision? Why is this potentially unsafe and what examples are there where one would NOT want to use --allow-unsafe?
A related question is: can I specify to "--allow-unsafe" ONLY for setuptools? It seems to be a parameter of pip-compile which is an all-or-nothing approach. Can I just flag the particular one as "ok to pin"? I would like to be warned again if some OTHER case arises so I can assess whether that's ok or not?
362
The most common command is pip freeze > requirements. txt , which records an environment's current package list into requirements. txt. If you want to install the dependencies in a virtual environment, create and activate that environment first, then use the Install from requirements.
Therefore, you should use pip list and pip freeze as follows: If you want to check a list of packages with various conditions, use pip list . If you want to create requirements. txt , use pip freeze .
Updating requirements If pip-compile finds an existing requirements. txt file that fulfils the dependencies then no changes will be made, even if updates are available. To force pip-compile to update all packages in an existing requirements. txt, run pip-compile --upgrade.
A requirements file is a list of all of a project's dependencies. This includes the dependencies needed by the dependencies. It also contains the specific version of each dependency, specified with a double equals sign ( == ).
So now my predicament is: should I use
--allow-unsafe? What are the implications of doing this?
Yes, you should. This option allows you to pin in requirements.txt the following packages: distribute, pip, and setuptools. If you don't care, go ahead!
But why is this unsafe?
AFAIK, those packages could be considered unsafe for the following reasons:
setuptools may cause conflicts with pip (
distribute is the legacy wrapper of setuptools, and it's
deprecated since 2013).pip could break pip-tools itself or your system pip.The --allow-unsafe option most likely will be deprecated in the near future, see discussions in pip-tools' and pip's issue-trackers.
183
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
