[19:20:18] <buzzedword> hey folks! question-- i'm currently setting up an automated stack for my python devs. i've run into an issue where a) requirements.txt does not list requirements in dependency order, resulting in a hard crash on install
[19:20:55] <buzzedword> and b) on arbitrary apps, some of the packages are unverified, and i need to explicitly name the package to be verified
[19:22:00] <buzzedword> has there been any documented process to install all requirements in a requirements.txt and their dependencies?
[19:22:30] <buzzedword> also-- just as you can allow-all-external, can you do something like allow-all-unverified?
[20:06:39] <ronny> buzzedword: recent pip versions allow you to list --foo lines in requirements.txt
[20:07:01] <ronny> buzzedword: if dependency order is an issue the packages are broken and you need to provide a fix to them
[20:08:03] <buzzedword> ronny: by provide a fix, i'm assuming you mean patching upstream
[20:09:18] <ronny> in the meantime using a devpi server and pushing local versions can elevate the problem
[20:10:37] <buzzedword> ronny: so, one of the most recent examples i can cite-- using a data science setup to install package "mrec" which depends on "scipy" -- scipy is also defined in requirements.txt
[20:10:50] <buzzedword> you're saying if dep order breaks here, the package itself is busted?
[20:11:15] <buzzedword> just trying to make sure i understand correctly
[20:11:38] <ronny> buzzedword: if it needs something for install/setup, it should have it in install_requires or setup_requires
[20:14:34] <ronny> also all packages not on pypi - please mail them regular for unsecure messy download fuckups, if enough people do that they might stop
[20:15:21] <buzzedword> sorry-- can you clarify a bit what you mean there?
[20:15:46] <buzzedword> as in, if a package is broken, mail pypi or the package owner?