
Product
Introducing Socket Fix for Safe, Automated Dependency Upgrades
Automatically fix and test dependency updates with socket fix—a new CLI tool that turns CVE alerts into safe, automated upgrades.
This is a PEP 517 build backend to act as a "soft link" between a package released on a 3rd party package index and pypi.org. This allows users to keep the simple UX of pip install foo
while hosting the actual wheel files on a non-PyPi index.
hatch shell
hatch build -t wheel
cd demo
wget https://pypi.nvidia.com/nvidia-cuda-runtime-cu12/nvidia_cuda_runtime_cu12-12.4.99-py3-none-manylinux2014_x86_64.whl
PIP_FIND_LINKS=`pwd`/../dist PIP_NO_INDEX=1 python -m build --sdist --config-setting source_wheel=nvidia_cuda_runtime_cu12-12.4.99-py3-none-manylinux2014_x86_64.whl
There should now be a new dist/
folder with e.g. nvidia_cuda_runtime_cu12-12.4.99.tar.gz
pip install --no-cache ./dist/<my_sdist>.tar.gz
Feel free to test with --extra-index-url https://pypi.nvidia.com
as well.There are a few configuration options available for wheel_stub
. These can be set in your pyproject.toml
file:
index_url
: The url to the 3rd party index to install wheels from. This is the only required configuration setting.
stub_only
: Do not install the wheel from the 3rd party package repository, instead erroring with instructions of how to use the repository directly. This can be used in cases such as a project which depends on non-PyPi dependencies, which would get rejected from pypi.org. Set automatically based on project dependencies. true
or false
(default false
)
include_cuda_debuginfo
: Whether to query information about the available CUDA runtime when reporting an error. true
or false
(default false
)
This project is released under the Apache-2 license. It vendors the packaging
project, which is BSD 2-clause and Apache 2 dual licensed. It also vendors tomli
, which is MIT licensed. For more details see the LICENSE file.
FAQs
wheel stub package build backend
We found that wheel-stub demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Automatically fix and test dependency updates with socket fix—a new CLI tool that turns CVE alerts into safe, automated upgrades.
Security News
CISA denies CVE funding issues amid backlash over a new CVE foundation formed by board members, raising concerns about transparency and program governance.
Product
We’re excited to announce a powerful new capability in Socket: historical data and enhanced analytics.