nbpreview VS pip

I haven't personally tried it but this project uses it with rich.

This alone resolves one of the major backtracking problems that first appeared once the new resolver landed (installing apache-airflow 1.10.13), I carefully tested here to show that a hack introduced in to Pip's backtracking choices can now be removed: https://github.com/pypa/pip/issues/11836

Slightly tangential, but... one also does not simply `pip download` if one does not want execute code - https://github.com/pypa/pip/issues/1884.

I wanted to run guarddog on source packages. Only then build them locally and install. Turns out, pip download triggers code execution in fetched packages.

Somewhat surprising and in this day and age worth spreading awareness of.

> even package managers like pip

This reminds me of a blog post [1] I read before. Pertinent quote:

> Unbeknownst to me, even with --dry-run pip will execute arbitrary code found in the package's setup.py. In fact, merely asking pip to download a package can execute arbitrary code (see pip issues 7325 [2] and 1884 [3] for more details)!

Also seen on Twitter [4].

[1] https://moyix.blogspot.com/2022/09/someones-been-messing-wit...

[2] https://github.com/pypa/pip/issues/7325

[3] https://github.com/pypa/pip/issues/1884

[4] https://twitter.com/moyix/status/1566561433898426368

Ultimately it needs to be "Python.org" that endorses the tool, not PyPA, no one in the scheme of things know who PyPA are and if it's the "one true way".

If you got to Python.org and follow through to the beginners guide [0] this is what's suggested:

> There are several methods to install additional Python packages:

> Packages can be installed via the standard Python distutils mode (python setup.py install).

> Many packages can also be installed via the setuptools extension or pip wrapper, see https://pip.pypa.io/.

That is so out of date and fundamentally confuses people coming to Python for the first time.

The PyPA need to get buy in from Python Core to put one tool front and centre first. It needs to be like Rust with Cargo, literally the first thing you learn to use and core to all beginners guides.

That's not to diminish the work of PyPA, you are all amazing I just want your work to be more obvious!

0: https://docs.python.org/3/using/mac.html#installing-addition...

~/tmp $ python3 -m venv --copies testvenv ~/tmp $ testvenv/bin/pip install xkcdpass Collecting xkcdpass Using cached xkcdpass-1.19.3.tar.gz (2.6 MB) Preparing metadata (setup.py) ... done Installing collected packages: xkcdpass DEPRECATION: xkcdpass is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559 Running setup.py install for xkcdpass ... done Successfully installed xkcdpass-1.19.3 ~/tmp $ testvenv/bin/xkcdpass travesty sizzling untying penpal impish matchbox ~/tmp $ head -n 1 testvenv/bin/xkcdpass #!/home/vinay/tmp/testvenv/bin/python3 ~/tmp $ mv testvenv testvenv2 ~/tmp $ testvenv2/bin/xkcdpass bash: testvenv2/bin/xkcdpass: /home/vinay/tmp/testvenv/bin/python3: bad interpreter: No such file or directory

DEPRECATION: cchardet is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559

pip: 13'441 commits, 86'573 objects, 66.2 MiB packed, 211 MiB unpacked

% pip install --global-option='build_ext' --global-option='-I/opt/homebrew/include/portaudio.h' --global-option='-L/opt/homebrew/Cellar/portaudio/19.7.0/include/portaudio.h' pyaudio WARNING: Implying --no-binary=:all: due to the presence of --build-option / --global-option / --install-option. Consider using --config-settings for more flexibility. DEPRECATION: --no-binary currently disables reading from the cache of locally built wheels. In the future --no-binary will not influence the wheel cache. pip 23.1 will enforce this behaviour change. A possible replacement is to use the --no-cache-dir option. You can use the flag --use-feature=no-binary-enable-wheel-cache to test the upcoming behaviour. Discussion can be found at https://github.com/pypa/pip/issues/11453 Collecting pyaudio Using cached PyAudio-0.2.12.tar.gz (42 kB) Installing build dependencies ... done Getting requirements to build wheel ... done Preparing metadata (pyproject.toml) ... done Building wheels for collected packages: pyaudio WARNING: Ignoring --global-option when building pyaudio using PEP 517 Building wheel for pyaudio (pyproject.toml) ... error error: subprocess-exited-with-error

pip was also installed by pyenv. It is the package manager for Python.