{"id":23395962,"url":"https://github.com/matthewdeanmartin/caniuseonlywheels","last_synced_at":"2025-04-08T17:19:46.773Z","repository":{"id":62560788,"uuid":"435595389","full_name":"matthewdeanmartin/caniuseonlywheels","owner":"matthewdeanmartin","description":"Can I use only wheels and not insecure sdist?","archived":false,"fork":false,"pushed_at":"2023-11-12T20:08:18.000Z","size":750,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-21T12:58:59.331Z","etag":null,"topics":["pip","pipenv","safety","wheels"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/matthewdeanmartin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-12-06T17:56:46.000Z","updated_at":"2023-01-04T01:34:29.000Z","dependencies_parsed_at":"2025-02-14T13:49:44.025Z","dependency_job_id":null,"html_url":"https://github.com/matthewdeanmartin/caniuseonlywheels","commit_stats":null,"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewdeanmartin%2Fcaniuseonlywheels","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewdeanmartin%2Fcaniuseonlywheels/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewdeanmartin%2Fcaniuseonlywheels/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewdeanmartin%2Fcaniuseonlywheels/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/matthewdeanmartin","download_url":"https://codeload.github.com/matthewdeanmartin/caniuseonlywheels/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247888568,"owners_count":21013002,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["pip","pipenv","safety","wheels"],"created_at":"2024-12-22T07:19:45.596Z","updated_at":"2025-04-08T17:19:46.753Z","avatar_url":"https://github.com/matthewdeanmartin.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Can I Use Only Wheels?\n\nAre you worried about supply chain risks? You should be. Any clown can highjack a pypi package\nand replace with a malicious package that can run malicious code on:\n- install pip/setup.py *\n- import\n- invocation\n\nCan't do anything about import and invocation, but it is unnecessary to run setup.py, **always\ninstall wheels**, using the following switches.\n\n```bash\nexport PIP_ONLY_BINARY=:all:\npipenv install termcolor --skip-lock\n# or\npip install termcolor --only-binary=:all:\n```\n\nBut now you need to find out one by one, what in your requirements.txt doesn't support wheels!\n\nFortunately, here is a tool, based on the guts of caniusepython3.\n\n### So what do I do if the project doesn't have a wheel?\nAll the options have serious pros and cons. Some options are only available if you have\na direct dependency. If you have a transitive dependency, i.e. you want to install package A,\nwhich in turn installs package B, which doesn't have a wheel. In such a case you must convince\nB to publish a wheel or convince A to vendorize/remove the dependency.\n\n* Use piwheels add to /etc/pip.conf.\n```\n[global]\nextra-index-url=https://www.piwheels.org/simple\n```\nPiwheels.org is now another volunteer organization you will depend on in addtion to pypi.\n\n* Ask the package owner to make a wheel.\n\n* If the package owner published the script that published to pypi, offer a PR to include bdist_wheel\n \n* Offer to become a contributor on the github repo if the owner doesn't want to be bothered with the work of doing \n   pull requests\n\n* If you have a direct dependency, fork it and publish `project-name-whl` to pypi. This creates a maintenance\n   headache keeping them in sync!\n\n* If you have a direct dependency, vendorize the code. This is also a maintenance pain for keeping in sync with upgrades!\n\n* If the project is abandoned and meets many other criteria, attempt a PEP 541 takeover of the pypi name and \n   then publish a wheel. The pypi.org really can't cope with these requests, it is very burdensome because of the risk of abuse.\n\n\n## Installation\n```bash\npip install caniuseonlywheels  --only-binary=:all:\n```\n\n## Usage\n```bash\npip freeze\u003erequirements.txt\npython -m caniuseonlywheels -r requirements.txt --verbose\n```\n\n## Credits\nForked from \"caniusepython3\", Apache License, Original developer - Brett Cannon.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatthewdeanmartin%2Fcaniuseonlywheels","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatthewdeanmartin%2Fcaniuseonlywheels","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatthewdeanmartin%2Fcaniuseonlywheels/lists"}