Re: [libre-riscv-dev] libre-riscv-dev Digest, Vol 23, Issue 16

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Friday, July 10, 2020, Jacob Lifshay <programmerjake@gmail.com> wrote:

> apparently whitequark fixed the dependency issues with nmigen_soc:
> https://github.com/nmigen/nmigen-soc/commit/5509bd2aad3012eed09c06f660cb9b
> 60cd2cff95
>
> So, if you install from https://github.com/nmigen/nmigen-soc instead
> of PyPI or m-labs it will probably work


  install_requires=["nmigen>=0.1,<0.5"],


that will...sort-of do the trick.

installation of nmigen-soc will pull in an arbitrary, unverified and
untrusted version of nmigen off the internet

then, you git clone the nmigen repo and install that.

the pre-installed nmigen-soc dependencies will *match* the version of
nmigen being installed manually, resulting in successful replacement.

we are going to have to sort this out for the reproducible builds for
coriolis2

we absolutely cannot have arbitrary dependencies randomly downloaded, not
for any reason.

any one of those arbitrary untrusted packages could result in major
differences in the GDSII files

i mean *all* dependencies of nmigen.

pip3 is basically completely inappropriate, here, given that it could
result in USD 10 to 20 million dollars in NREs wasted because some random
software got installed.

l.



-- 
---
crowd-funded eco-conscious hardware: https://www.crowdsupply.com/eoma68
_______________________________________________
libre-riscv-dev mailing list
libre-riscv-dev@lists.libre-riscv.org
http://lists.libre-riscv.org/mailman/listinfo/libre-riscv-dev