pip安装请求[安全] vs pip安装请求:差异

Question

我正在使用Ubuntu 14.04(Trusty Tahr)和Python 2.7.6版.今天,当我创建一个新的virtualenv并尝试过的时候pip install requests,我收到了错误InsecurePlatformWarning.

我在使用Requests包时按照SSL InsecurePlatform错误中的说明解决了此问题.

但我想了解这两个命令之间的实际区别是什么: pip install requests[security]和pip install requests.

1. 为什么前者安装了三个额外的包？

2. 当我将代码推送到生产环境时,有什么需要注意的事项吗？

3. 他们一般都表现得一样吗？

Answer 1

为什么前者安装3个额外的包？

使用requests[security]而不是requests将安装三个额外的包:

• pyOpenSSL
• 加密
• IDNA

These are defined in extras_requires, as optional features with additional dependencies.

Are there any things that I need to take care about when I push the code to production?

You'd want to make sure that you are able to install those additional packages without any issues and that any changes to the way SSL connections work don't affect your usage.

Do they both behave the same generally?

Using these packages as opposed to the default standard library options will allow for more secure SSL connections.

For more information, here's the pull request where it was merged in and here is the issue where it was discussed.

(From the comments, for when GitHub goes away):

因此,当您使用pyOpenSSL,ndg-httspclient和pyasn1时,SSL连接比使用stdlib选项更安全.然而,实际上很难记住这三件事.如果请求会为它的setup.py添加一个额外的内容,那么人们可以用betterssl安装请求(Donald Stufft)会很酷

此外,默认情况下,由于古老的OpenSSL,请求无法连接到OS X上的某些站点.使用上述3个包可以实现.(唐纳德·斯托弗)