homebrew-core VS asdf-python

Is disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of thousands of projects [1]. These monorepos seem like a prime target for attack and if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.

[1] https://github.com/Homebrew/homebrew-core

> Correct. Though we do not appear to be affected, this revert was done out of an abundance of caution.

[1] https://github.com/Homebrew/homebrew-core/pull/167512

> right, but now you know even less about your setup when you some roadblock

This is the same with a binary though. And with homebrew, you can't follow patches or flags used or if they change.

- https://github.com/Homebrew/homebrew-core/blob/c964ad7fa53ad...

definitely be careful about using fortune in a corporate environment or public space if you don't know what dat files you are using or you might just get an extremely unwelcome surprise.

I was practicing a presentation and used to use "fortune" all the time. I forget exactly what it output but I remember being absolutely mortified about what could have happened if that had popped up during an internal company tech talk.

Kudos to brew for keeping unsuspecting people safe

https://github.com/Homebrew/homebrew-core/commit/3fb3c4c3e55...

I'm sorry to be asking this as I find it a bit silly, but it's blocking my PR [3], so could a few of you star the project on Github [1] to get my PR to run?

[1] https://github.com/laktak/chkbit-py

[2] https://brew.sh

[3] https://github.com/Homebrew/homebrew-core/pull/160018

Point of clarification: asdf uses python-build which is from pyenv.

https://github.com/asdf-community/asdf-python?tab=readme-ov-...

[env] # supports arbitrary env vars so mise can be used like direnv/dotenv NODE_ENV = 'production' [tools] # specify single or multiple versions terraform = '1.0.0' erlang = ['23.3', '24.0'] # supports everything you can do with .tool-versions currently node = ['16', 'prefix:20', 'ref:master', 'path:~/.nodes/14'] # send arbitrary options to the plugin, passed as: # MISE_TOOL_OPTS\_\_VENV=.venv python = {version='3.10', virtualenv='.venv'} [plugins] # specify a custom repo url # note this will only be used if the plugin does not already exist python = 'https://github.com/asdf-community/asdf-python' [alias.node] # project-local aliases my_custom_node = '20'

Yeah, I should've been more precise. The asdf plugins use parts of existing systems. For example (python/ruby/node)-build which mostly come from other version managers. Asdf does provide extras, but the plugin-specific code is tiny: https://github.com/asdf-community/asdf-python/blob/master/bi...

❯ asdf plugin-list --urls --refs act https://github.com/grimoh/asdf-act.git master 8729029 aws-vault https://github.com/beardix/asdf-aws-vault.git master 937a1db awscli https://github.com/MetricMike/asdf-awscli.git main b9ba4c7 docker-slim https://github.com/everpeace/asdf-docker-slim.git master 4ee75a3 golang https://github.com/kennyp/asdf-golang.git master 1f388f1 helm https://github.com/Antiarchitect/asdf-helm.git master 87eef5a java https://github.com/halcyon/asdf-java.git master f0c702f jq https://github.com/ryodocx/asdf-jq.git master 3144577 kubectl https://github.com/asdf-community/asdf-kubectl.git master da7bb0b minikube https://github.com/alvarobp/asdf-minikube.git master 8ca7b8d mysql https://github.com/iroddis/asdf-mysql.git master 3aaf756 nodejs https://github.com/asdf-vm/asdf-nodejs.git master cb61e3d perl https://github.com/ouest/asdf-perl.git master 31bb799 php https://github.com/asdf-community/asdf-php.git master 759843b postgres https://github.com/smashedtoatoms/asdf-postgres.git master 4f8b356 python https://github.com/danhper/asdf-python.git master 8ab052f redis https://github.com/smashedtoatoms/asdf-redis.git master bf1276e ruby https://github.com/asdf-vm/asdf-ruby.git master f134c2d sbt https://github.com/bram2000/asdf-sbt.git master 33f9637 scala https://github.com/asdf-community/asdf-scala.git master 1206055 skaffold https://github.com/virtualstaticvoid/asdf-skaffold.git master c942ecf spark https://github.com/joshuaballoch/asdf-spark.git master 6fe49de

You could look at what a new $PATH file looks like by spinning up a new VM or google around for default path examples. As for your dependency issues, I like to use poetry and asdf to keep things straight.

I use asdf and its Python plugin [1] to install Python interpreter versions.

For managing virtual environments on my preferred shell (Fish), I use (and maintain) VirtualFish [2].

For managing project dependencies, I activate environments via VirtualFish and then use Poetry [3] to update the dependencies within the environments.

[1]: https://github.com/danhper/asdf-python

[2]: http://github.com/justinmayer/virtualfish

[3]: http://python-poetry.org