How to distribute a package with self-contained local dependencies?

user_12173451 0
Viewed 331

I have some local packages hosted on my own machine, I would like to include a copy of them in distribution of other packages that depends on them. When installing a local package, pip freeze shows something like

public-package==3.0.1
local-package @ file:///home/user/local-package/dist/local-package-1.0.0.tar.gz

but if one try to install that package on other computer will get error from pip because local-package path does not exist. Can I extend setup.py commands to process that requirements.txt file, extract local packages path, copy local packages into deps folder of dist archive and rewrite requirements.txt like

public-package==3.0.1
local-package @ deps/local-package-1.0.0.tar.gz

and make pip treat deps/ as a relative path to the package archive itself?

pip python
1 Answers

I managed to do it with source distributions and overriding sdist and egg_info commands to make setuptools bundle local dependencies together with package and to make pip search dependencies in that bundle when installing the built package later. But later I figured out it makes system vulnerable to dependency confusion attacks because local packages installed from that bundle are visible with pip freeze, if for some reason the dependency location, like local-package @ file:///home/user/packages/local-package.tar.gz is stripped to just local-package pip will search it on pypi, which allows dependency confusion to happen.

The best solution for this problem is to vendor all local dependencies where their source code is copied to the package, pip itself vendors its dependencies using vendoring.

user_121734510
Related