Skip to content
Search

Python:Requirements

lastmod 2026-04-01created 2021-03-1313 edits

Categories

No Binary 

pip install --no-binary=protobuf protobuf

A requirements.txt file that does the same as above looks like this: 

spam --no-binary=eggs
bacon --only-binary=eggs

requirements.txt vs constraints.txt

See Python:Constraints#requirements.txt vs constraints.txt for details.

Version specifiers

Ways to specify versions, such as ~=. See PEP 440#Version specifiers for details.

Requirements File Format

To search for packages on multiple sites, write it as follows. 

# Torch
--find-links https://download.pytorch.org/whl/torch_stable.html
torch==1.5.0+cu101
torchvision==0.6.0+cu101

# Detectron
--find-links https://dl.fbaipublicfiles.com/detectron2/wheels/cu101/index.html
detectron2

Compare Operators

The ~= operator

Adding to the existing answers, I think it's very important to also mention that while 

~=0.6.10 means >=0.6.10, ==0.6.*

Following is also true 

~=0.6 means >=0.6, ==0.*

Somewhat complex constraints

The pyproject.toml file of opencv-python looks like this: 

[build-system]
requires = [
  "cmake>=3.1",
  "numpy==1.13.3; python_version=='3.6' and platform_machine != 'aarch64' and platform_machine != 'arm64'",
  "numpy==1.17.0; python_version=='3.7' and platform_machine != 'aarch64' and platform_machine != 'arm64'",
  "numpy==1.17.5; python_version=='3.8' and platform_machine != 'aarch64' and platform_machine != 'arm64'",
  "numpy==1.19.3; python_version<'3.9' and sys_platform == 'linux' and platform_machine == 'aarch64'",
  "numpy==1.21.0; python_version<'3.9' and sys_platform == 'darwin' and platform_machine == 'arm64'",
  "numpy>=2.0.0;  python_version>='3.9'",
  "pip",
  "scikit-build>=0.14.0",
  "setuptools==59.2.0",
]

Or the setup.py file: 

    install_requires = [
        'numpy>=1.13.3; python_version<"3.7"',
        'numpy>=1.17.0; python_version>="3.7"', # https://github.com/numpy/numpy/pull/13725
        'numpy>=1.17.3; python_version>="3.8"',
        'numpy>=1.19.3; python_version>="3.9"',
        'numpy>=1.21.2; python_version>="3.10"',
        'numpy>=1.19.3; python_version>="3.6" and platform_system=="Linux" and platform_machine=="aarch64"',
        'numpy>=1.21.0; python_version<="3.9" and platform_system=="Darwin" and platform_machine=="arm64"',
        'numpy>=1.21.4; python_version>="3.10" and platform_system=="Darwin"',
        "numpy>=1.23.5; python_version>='3.11'",
        "numpy>=1.26.0; python_version>='3.12'"
    ]

Package finding flags

--index-url
Replaces pip's default index (PyPI). When set, pip no longer looks at https://pypi.org/simple and searches only the one specified URL. Only one can be specified.
--extra-index-url
Adds a PEP 503 index server (same structure as PyPI) as an extra index on top of the default PyPI. pip searches both PyPI and the specified URL, and takes a package with a matching version from wherever it finds one. Multiple can be added
--no-index
Ignores all index servers and uses only --find-links
--find-links
Simply points to an HTML page or directory that lists wheel files.

Security caveat

Because --extra-index-url looks at two indexes at once, it can be vulnerable to dependency confusion attacks. If an attacker uploads a package to PyPI with the same name as an internal package and a higher version, pip may install it. In security-sensitive environments, it is recommended to specify only the internal mirror with --index-url, or to use pip's --require-hashes option together instead of --extra-index-url.

--no-binary :all:
Ignores wheels and forces building from source
--only-binary :all:
Ignores sdists and allows only wheels (no building)
--no-binary<pkg>
Forces a source build for specific packages only
--only-binary<pkg>
Forces wheels for specific packages only
--trusted-host
Specifies hosts for which to skip SSL verification (internal mirrors, etc.)

Hash checking

Adding --require-hashes forces pip to verify the hashes of all packages: 

# requirements.txt
--require-hashes

requests==2.31.0 \
    --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7f0edf3fcb0fce8afe0f44064ad1e1b68

certifi==2024.2.2 \
    --hash=sha256:dc383c07b76109f368f6106eee2b593b04a011ea4d55f652c6ca24a754d1cdd1

Including other requirements.txt files 

-r requirements-dev.txt
-r requirements-test.txt

See also

Favorite site

author Zer0 sitemap