Dne 08. 03. 21 v 18:33 Mattia Verga via devel napsal(a):
In what way is different from installing them by pip? Does packaging
them worth spending resources (disk space, Koji cycles) and packagers time?
1. You know from where the package comes. Verified using GPG checks. Helps to avoid
Dependency Confusions attacks
https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
2. You can audit files on your disk using rpm -qf /some/file
Nothing stops you to create these packages automatically using `pyp2rpm`.
--
Miroslav Suchy, RHCA
Red Hat, Associate Manager, Community Packaging Tools, #brno, #fedora-buildsys