this post was submitted on 06 Nov 2024
77 points (97.5% liked)

Programming

17339 readers
236 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]



founded 1 year ago
MODERATORS
 

So I'm no expert, but I have been a hobbyist C and Rust dev for a while now, and I've installed tons of programs from GitHub and whatnot that required manual compilation or other hoops to jump through, but I am constantly befuddled installing python apps. They seem to always need a very specific (often outdated) version of python, require a bunch of venv nonsense, googling gives tons of outdated info that no longer works, and generally seem incredibly not portable. As someone who doesn't work in python, it seems more obtuse than any other language's ecosystem. Why is it like this?

top 34 comments
sorted by: hot top controversial new old
[–] [email protected] 2 points 40 minutes ago

Docker might be solution here.

But from my experience most python scripts are absolute junk. The barrier for entry is low so there's a massive disparity in quality.

[–] [email protected] 7 points 3 hours ago

everyone focuses on the tooling, not many are focusing on the reason: python is extremely dynamic. like, magic dynamic you can modify a module halfway through an import, you can replace class attributes and automatically propagate to instances, you can decompile the bytecode while it's running.

combine this with the fact that it's installed by default and used basically everywhere and you get an environment that needs to be carefully managed for the sake of the system.

js has this packaging system down pat, but it has the advantage that it got mainstream in a sandboxed isolated environment before it started leaking out into the system. python was in there from the beginning, and every change breaks someone's workflow.

the closest language to look at for packaging is probably lua, which has similar issues. however since lua is usually not a standalone application platform it's not a big deal there.

[–] [email protected] 36 points 5 hours ago

Python's packaging is not great. Pip and venvs help but, it's lightyears behind anything you're used to. My go-to is using a venv for everything.

[–] [email protected] 30 points 5 hours ago (2 children)

It's something of a "14 competing standards" situation, but uv seems to be the nerd favourite these days.

[–] [email protected] 11 points 5 hours ago (1 children)

I still do the python3 -m venv venv && source venv/bin/activate

How can uv help me be a better person?

[–] [email protected] 3 points 4 hours ago (1 children)

And pip install -r requirements.txt

[–] [email protected] 4 points 2 hours ago

Fuck it, I just use sudo and live with the consequences.

[–] [email protected] 2 points 5 hours ago (1 children)

This! Haven't used that one personally, but seeing how good ruff is I bet it's darn amazing, next best thing that I used has been PDM and Poetry, because Python's first party tooling has always been lackluster, no cohesive way to define a project and actually work it until relatively recently

[–] [email protected] 1 points 58 minutes ago* (last edited 56 minutes ago)

I moved all our projects (and devs) from poetry to uv. Reasons were poetry's non standard pyproject.toml syntax and speed, plus some weird quirks, e. g. if poetry asks for input and is not run with the verbose flag, devs often don't notice and believe it is stuck (even though it's in the default project README).

Personally, I update uv on my local machine as soon as a new release is available so I can track any breaking changes. Couple of months in, I can say there were some hiccups in the beginning, but currently, it's smooth sailing, and the speed gain really affects productivity as well, mostly due to being able to not break away from a mental "flow" state while staring at updates, becoming suspicious something might be wrong. Don't get me wrong, apart from the custom syntax (poetry partially predates the pyproject PEP), poetry worked great for us for years, but uv feels nicer.

Recently, "uv build" was introduced, which simplified things. I wish there was an command to update the lock file while also updating the dependency specs in the project file. I ran some command today and by accident discovered that custom dependency groups (apart from e. g. "dev") have made it to uv, too.

"uv pip" does some things differently, in particular when resolving packages (it's possible to switch to pip's behavior now), but I do agree with the decisions, in particular the changes to prevent "dependency confusion" attacks.

As for the original question: Python really has a bit of a history of project management and build tools, I do feel however that the community and maintainers are finally getting somewhere.

cargo is a bit of an "unfair" comparison since its development happened much more aligned with Rust and its whole ecosystem and not as an afterthought by third party developers, but I agree: cargo is definitely a great benchmark how project and dependency management plus building should look like, along with rustup, it really makes the developer experience quite pleasant.

The need for virtual environments exists so that different projects can use different versions of dependencies and those dependencies can be installed in a project specific location vs a global, system location. Since Python is interpreted, these dependencies need to stick around for the lifetime of the program so they can be imported at runtime. poetry managed those in a separate folder in e. g. the user's cache directory, whereas uv for example stores the virtual environment in the project folder, which I strongly prefer.

cargo will download the matching dependencies (along with doing some caching) and link the correct version to the project, so a conceptual virtual environment doesn't need to exist for Rust. By default, rust links everything apart from the C runtime statically, so the dependencies are no longer neesed after the build - except you probably want to rebuild the project later, so there is some caching.

Finally, I'd also recommend to go and try setting up a project using astral's uv. It handles sane pyproject.toml files, will create/initialize new projects from a template, manages virtual environments and has CLI to build e. g. wheels or source distribution (you will need to specify which build backend to use. I use hatchling), but thats just a decision you make and express as one line in the project file. Note: hatchling is the build backend, hatch is pypa's project management, pretty much an alternative to poetry or uv.

uv will also install complete Python distributions (e. g. Python 3.12) if you need a different interpreter version for compatibility reasons

If you use workspaces in cargo, uv also does those.

uv init, uv add, uv lock --upgrade, uv sync, uv build and how uv handles tools you might want to install and run should really go a long way and probably provide an experience somewhat similar to cargo.

[–] kSPvhmTOlwvMd7Y7E 20 points 6 hours ago (1 children)

You re not stupid, python's packaging & versionning is PITA. as long as you write it for yourself, you re good. As soon as you want to share it, you have a problem

[–] MajorHavoc 8 points 5 hours ago

as long as you write it for yourself, you re good. As soon as you want to share it, you have a problem

A perfect summary of the history of computer code!

[–] [email protected] 7 points 5 hours ago

With all the hype surrounding Python it's easy to forget that it's a really old language. And, in my opinion, the leadership is a bit of a mess so there hasn't been any concerted effort on standardizing tooling.

Some unsolicited advice from somebody who is used more refined build environments but is doing a lot of Python these days:

The whole venv thing isn't too bad once you get the hang of it. But be prepared for people to tell you that you're using the wrong venv for reasons you'll never quit understand or likely need to care about. Just use the bundled "python -m venv venv" and you'll be fine despite other "better" alternatives. It's bundled so it's always available to you. And feel free to just drop/recreate your venv whenever you like or need. They're ephemeral and pretty large once you've installed a lot of things.

Use "pipx" to install python applications you want to use as programs rather than libraries. It creates and manages venvs for them so you don't get library conflicts. Something like "pip-tools" for example (pipx install pip-tools).

Use "pyenv" to manage installed python versions - it's a bit like "sdkman" for the JVM ecosystem and makes it easy to deal with the "specific versions of python" stuff.

For dependencies for an app - I just create a requirements.txt and "pip install -r requirements.txt" for the most part... Though I should use one of the 80 better ways to do it because they can help with updating versions automatically. Those tools mostly also just spit out a requirements.txt in the end so it's pretty easy to migrate to them. pip-tools is what my team is moving towards and it seems a reasonable option. YMMV.

[–] [email protected] 17 points 6 hours ago

Python never had much of a central design team. People mostly just scratched their own itch, so you get lots of different tools that do only a small part each, and aren't necessarily compatible.

[–] [email protected] 12 points 6 hours ago

I agree. Python is my language of choice 80% or so of the time.

But my god, it does packaging badly! Especially if it's dependent on linking to compiled code!

Why it is like that, I couldn't tell. The language is older than git, so that might be part of it.

However, you're installing python libraries from github? I very very rarely have to do that. In what context do you have to do that regularly?

[–] [email protected] 6 points 6 hours ago* (last edited 5 hours ago) (1 children)

venv nonsense

I mean, the fact that it isn't more end-user invisible to me is annoying, and I wish that it could also include a version of Python, but I think that venv is pretty reasonable. It handles non-systemwide library versioning in what I'd call a reasonably straightforward way. Once you know how to do it, works the same way for each Python program.

Honestly, if there were just a frontend on venv that set up any missing environment and activated the venv, I'd be fine with it.

And I don't do much Python development, so this isn't from a "Python awesome" standpoint.

[–] [email protected] 1 points 48 minutes ago

pyenv and uv let you install and switch between multiple Python versions.

As for uv, those come from the Python build standalone project, if I remember correctly, pyenv also installs from there, but don't quote me on that.

[–] [email protected] 3 points 5 hours ago

Yeah the tooling sucks. The only tooling I've liked is Poetry, I never have trouble installing or packaging the apps that use it.

[–] [email protected] 4 points 6 hours ago* (last edited 6 hours ago)

This is exactly how I feel about python as well... IMHO, it's good for some advanced stuff, where bash starts to hit its limits, but I'd never touch it otherwise

[–] [email protected] 3 points 6 hours ago

It... depends. There is some great tooling for Python -- this was less true only a few years ago, mind you -- but the landscape is very much in flux, and usage of the modern stuff is not yet widespread. And a lot of the legacy stuff has a whole host of pitfalls.

Things are broadly progressing in the right direction, and I'd say I'm cautiously optimistic, although if you have to deal with anything related to conda then for the time being: good luck, and sorry.

[–] onlinepersona 0 points 3 hours ago* (last edited 3 hours ago)

Difficult? How so? I find compiling C and C++ stuff much more difficult than anything python. It never works on the first try whereas with python the chances are much much higher.

What's is so difficult to understand about virtual envs? You have global python packages, you can also have per user python packages, and you can create virtual environments to install packages into. Why do people struggle to understand this?

The global packages are found thanks to default locations, which can be overridden with environment variables. Virtual environments set those environment variables to be able to point to different locations.

python -m venv .venv/ means python will execute the module venv and tell it to create a virtual environment in the .venv folder in the current directory. As mentioned above, the environment variables have to be set to actually use it. That's when source .venv/bin/activate comes into play (there are other scripts for zsh and fish). Now you can run pip install $package and then run the package's command if it has one.

It's that simple. If you want to, you can make it difficult by doing sudo pip install $package and fucking up your global packages by possibly updating a dependency of another package - just like the equivalent of updating glibc from 1.2 to 1.3 and breaking every application depending on 1.2 because glibc doesn't fucking follow goddamn semver.

As for old versions of python, bro give me a break. There's pyenv for that if whatever old ass package you're installing depends on an ancient 10 year old python version. You really think building a C++ package from 10 years ago will work more smoothly than python? Have fun tracking down all the unlocked dependency versions that "Worked On My Machine 🏧" at the start of the century.

The only python packages I have installing are those with C/C++ dependencies which have to be compiled at install time.

Y'all have got to be meme'ing.

Anti Commercial-AI license

[–] [email protected] 1 points 5 hours ago (1 children)

The difficulty with python tooling is that you have to learn which tools you can and should completely ignore.

Unless you are a 100x engineer managing 500 projects with conflicting versions, build systems, docker, websites, and AAAH...

  • you don't really need venvs
  • you should not use more than on package manager (I recommend pip) and you should cling to it with all your might and never switch. Mixing e.g. conda, on linux system installers like apt, is the problem. Just using one is fine.
  • You don't "need" need any other tools. They are bonuses that you should use and learn how to use, exactly when you need them and not before. (type hinting checker, linting, testing, etc..)

Why is it like this?

Isolation for reliability, because it costs the businesses real $$$ when stuff goes down.

venvs exists to prevent the case that "project 1" and "project 2" use the same library "foobar". Except, "project 1" is old, the maintainer is held up and can't update as fast and "project 2" is a cutting edge start up that always uses the newest tech.

When python imports a library it would use "the libary" that is installed. If project 2 uses foobar version 15.9 which changed functionality, and project 1 uses foobar uses version 1.0, you get a bug, always, in either project 1 or project 2. Venvs solve this by providing project specific sets of libraries and interpreters.

In practice for many if not most users, this is meaningless, because if you're making e.g. a plot with matplotlib, that won't change. But people have "best practices" so they just do stuff even if they don't need it.

It is a tradeoff between being fine with breakage and fixing it when it occurs and not being fine with breakage. The two approaches won't mix.

very specific (often outdated) version of python,

They are giving you the version that they know worked. Often you can just remove the specific version pinning and it will work fine, because again, it doesn't actually change that much. But still, the project that's online was the working state.

[–] [email protected] 0 points 5 hours ago (2 children)

Coming at this from the JS world... Why the heck would 2 projects share the same library? Seems like a pretty stupid idea that opens you up to a ton of issues, so what, you can save 200kb on you hard drive?

[–] [email protected] 2 points 4 hours ago* (last edited 4 hours ago)

Why the heck would 2 projects share the same library?

Coming from the olden days, with good package management, infrequent updates and the idea that you wanted to indeed save that x number of bytes on the disk and in memory, only installing one was the way to go.

Python also wasn't exactly a high brow academic effort to brain storm the next big thing, it was built to be a simple tool and that included just fetching some library from your system was good enough. It only ended up being popular because it is very easy to get your feet wet and do something quick.

[–] [email protected] 2 points 5 hours ago

Yeah, not sure I would listen to this guy. Setting up a venv for each project is about a bare minimum for all the teams I've worked on.

That being said python env can be GBs in size (especially when doing data science).

[–] [email protected] 1 points 6 hours ago (1 children)

Tried to install Automatic1111 for Stable Diffusion in an Arch distrobox, and despite editing the .sh file to point to the older tarballed Python version as advised on Github, it still tells me it uses the most up to date one that's installed system wide and thus can't install pytorch. And that's pretty much where my personal knowledge ends, and apparently that of those (i.e. that one person) on Github. ¯\_(ツ)_/¯

Always funny when people urge you to ask for help but no one ends up actually helping.

[–] [email protected] 1 points 5 hours ago* (last edited 5 hours ago)

despite editing the .sh file to point to the older tarballed Python version as advised on Github, it still tells me it uses the most up to date one that's installed system wide and thus can't install pytorch.

Can you paste your commands and output?

If you want, maybe on [email protected], since I think that people seeing how to get Automatic1111 set up might help others.

I've set it up myself, and I don't mind taking a stab at getting it working, especially if it might help get others over the hump to a local Automatic1111 installation.

[–] [email protected] 1 points 6 hours ago (1 children)

I'm no Python expert either and yeah, from an outsider's perspective it seems needlessly confusing. easy_install that's never been easy, pip that should absolutely be put on a Performance Improvement Plan, and now this venv nonsense.

You can criticize javascript's ridiculous dependencies all you want (left-pad?), but one thing that they absolutely got right is how to manage them. Everything's in node_modules and that's it. Yeah, you might get eleven copies of left-pad on your system, but you know what you NEVER get? Version conflicts between projects you're working on.

[–] [email protected] 1 points 5 hours ago

Seriously. Those are EXACTLY the thoughts I had after I was forced to deal with Python after a ton of time writing projects in JS.

[–] [email protected] -4 points 6 hours ago (1 children)

This isn’t the answer you want, but Go(lang) is super easy to learn and has a ton of speed on python. Yes, it’s more difficult, but once you understand it, it’s got a lot going for it.

[–] [email protected] 2 points 3 hours ago* (last edited 3 hours ago) (1 children)

it's also not at all relevant. go is great, but this is about python.

[–] [email protected] 0 points 3 hours ago (1 children)

I’m sorry I offended you.

[–] [email protected] 2 points 3 hours ago (1 children)

this is not about offense! nobody is offended. but if you ask me for help with an apple pie and i tell you to make meatballs... it's a confusing lack of relevance.

[–] [email protected] 0 points 3 hours ago (1 children)

I did lead with an appropriate request for a sidebar. I just feel the rip about context was even less appropriate. And apple cobbler would be a better comparison. Apples, just different.

[–] [email protected] 2 points 2 hours ago

it's not though. op has issues installing programs built in python. suggesting they rebuild those programs in go is 100% an apples to meatballs comparison, and way off topic.