Today I had to downgrade fastapi from 0.114.0 to 0.112.4 to make a software work. And it just hit me - what if pip didn’t support 0.112.4 anymore? We would lose a good piece of software just because of that.
Of course, we can “freeze” the packages into an executable that will run for as long as the OS supports it. Which is a lot longer. But the executable is closed source. We can’t see the code that is run from an executable.
Therefore, there is a need for an alternative to which we still have access to the packages even after the program is built. That would make it safely unnecessary for pip to store all versions of all packages forever more.
Any ideas?
- CameronDev ( @CameronDev@programming.dev ) 28•12 days ago
If its an open source project, the answer is to rebuild from the tagged source.
Eg: https://github.com/fastapi/fastapi/tree/0.112.4
With the right repo setup, you can
pip install git+https://github.com/fastapi/fastapi.git@0.112.4
(example only, not sure it works), so pypi doesn’t need to keep all previous wheels, its just easier for it to do so. - Pol ( @pol@infosec.pub ) 4•11 days ago
Nix
- Nick ( @iamnickops@fosstodon.org ) 2•12 days ago
@obbeel What? You didn’t explain how. Your “why” is a little scatter-brained, dude.
What do you mean?
I just find that if pip did not support that version anymore, the software would be lost. As that is covered by making executables, as I mentioned them. But what if I wanted to have access to the libraries that were used in the program? That wouldn’t be possible. Because all we get in the source code is the dependency fetching, not the dependencies themselves.
It would be good to have an alternative where you get all that you need to compile the code again, not depending on fetching them from websites that might not even have them anymore.
This mentality of ephemeral code just adheres to the way big tech would like to do things, with programmed obsolescence.
An alternative to that way of doing things would be nice and would make sure we get access to the same working open source program in 30 or 40 years.
- CameronDev ( @CameronDev@programming.dev ) 6•12 days ago
I’m not sure there is a “mentality of ephemeral code” in open source projects. The source is literally available on github or similar, and anyone can mirror it as they like.
If it is popular enough, then the project is probably backed up in the github artic vault as well.
- N0x0n ( @N0x0n@lemmy.ml ) 2•12 days ago
While I don’t know of a solution I totally get what you mean… A lot of cool projects don’t work anymore because of that…
Something similar to the container technology, where everything is packed into an image with all it’s dependencies to the correct version. The app would probably be a security nightmare, but could still work in it’s own contained system.
This sounds like a very neat technology that Linux is missing !
- remram ( @remram@lemmy.ml ) 1•11 days ago
what if pip didn’t support 0.112.4 anymore?
What do you mean by that? If new versions of Python didn’t run that version of fastapi? If PyPI removed it?
If prior versions were not support by pip anymore, so yes, if it were removed. There are cases of packages not being supported by the platforms, aren’t there? I’ve run into cases where the package was fully deprecated and not useable or downloadable anymore.
- remram ( @remram@lemmy.ml ) 1•11 days ago
What do you mean “not supported by the platforms”? And do you mean that or “removed”?
I couldn’t download it even if I wanted to. That’s what I mean. It returns a message saying it isn’t supported.
- remram ( @remram@lemmy.ml ) 2•11 days ago
“It” being the PyPI server not finding it? Pip not supporting the API? Or it downloads correctly but the setup.py prints that error?
I think it said it’s deprecated or something? I’m not sure, I just know I had problems downloading packages before.
I don’t think it was setup.py . I think I tried to download it directly through pip install xx==0.4.0 or something (the version was required by the program) and it said the package doesn’t exist.
Anyway, more access to the open source packages can’t be bad.
- jlow (he/him) ( @jlow@beehaw.org ) 1•11 days ago
Nixpackages or Flatpaks/Appimages(/Snaps 🙈) are a general solution to this (not in this specific case probably), no?
But do Appimages make the dependencies code available? They pack everything into one working program, but what about the packages?