Open source alternative to executables
Open source alternative to executables
Today I had to downgrade fastapi from 0.114.0 to 0.112.4 to make a software work. And it just hit me - what if pip didn't support 0.112.4 anymore? We would lose a good piece of software just because of that.
Of course, we can "freeze" the packages into an executable that will run for as long as the OS supports it. Which is a lot longer. But the executable is closed source. We can't see the code that is run from an executable.
Therefore, there is a need for an alternative to which we still have access to the packages even after the program is built. That would make it safely unnecessary for pip to store all versions of all packages forever more.
Any ideas?
If its an open source project, the answer is to rebuild from the tagged source.
Eg: https://github.com/fastapi/fastapi/tree/0.112.4
With the right repo setup, you can
pip install git+https://github.com/fastapi/fastapi.git@0.112.4(example only, not sure it works), so pypi doesn't need to keep all previous wheels, its just easier for it to do so.There are hellish things such as guix for that.
Or ideally the software needs to be upgraded.
Nix as well
btw :)
There's plenty of open source projects that distribute executables (i.e. all that use compiled languages). The projects just provide checksums, ensure their builds are reproducible, or provide some other method to verify.
In practice, you're going to wind up in dependency hell before pypi stops hosting the package. E.g. you need to use package A and package B, but package A depends on v1 of package C, and package B depends on v2 of package C.
And you don't need to use pypi or pip at all. You could just download the code and directly from tbe repo, import it into your project (possibly needing to build if it has binary components). However, if it was on pypi before, then the source repo likely had all the code pip needs to install it (i.e. contains setup.py and any related files).
Nix
Isn't this the whole idea behind flatpak but everyone seems to hate it
Who hate flatpak?
I hate them (seriously).
It's basically a second distro inside your distro (try
du -chs /var/lib/flatpak/) and if something breaks (eg. last year mesa with my graphics card) it isn't easy to identify were the problem is (because all libs update at the same time), plus you can't just try a newer (or older) version of some lib as you would in your distro.Moreover, you can't flatpak CLI tools (also servers and OS components, but I guess the ubuntu folks are the only ones who care about those).
Nixpackages or Flatpaks/Appimages(/Snaps 🙈) are a general solution to this (not in this specific case probably), no?
But do Appimages make the dependencies code available? They pack everything into one working program, but what about the packages?
what if pip didn’t support 0.112.4 anymore?
What do you mean by that? If new versions of Python didn't run that version of fastapi? If PyPI removed it?
If prior versions were not support by pip anymore, so yes, if it were removed. There are cases of packages not being supported by the platforms, aren't there? I've run into cases where the package was fully deprecated and not useable or downloadable anymore.