Building pyreqwest, a high-performance Python HTTP client backed by Rust’s reqwest. It has gotten quite feature rich: async and sync APIs, similar ergonomic interface of reqwest, full type hints, and built-in testing/mocking. It has no unsafe code, and no Python-side dependencies. (Started after getting too annoyed with all the issues httpx has.)
I've recently updated an internal tool which basically acts as a configuration and dependency/context manager for performing hundreds of api calls. I added an httpx backend (to test vs the current urllib3 backend) and also introduced an async API (httpx as well). However, from your benchmarks it seems like I should've went with aiohttp for faster async? I will work on integrating pyreqwest as well
Yes httpx is badly broken. Eg its connection pooling implementation is not great at all. There are various issues in httpx/httpcore. There are also old open PRs trying to fix issues but maintainer(s) are just not intrested.
I have been working on a new Python HTTP client which is 100% Rust-based (sync+async). Using reqwest under the hood and providing everything it has to offer to Python land + much more. Also including mocking capabilities. Here: https://github.com/MarkusSintonen/pyreqwest
Started from the poor state of many Python HTTP clients and poor testing utilities there is for them. (Eg the neglected state of httpx and its all perf issues)
SHA pinning won't necessarily help if the dependency you are pinning doesn't pin its own dependencies! You still get stuff pulled via vulnerable tags etc. How long till we get this https://github.com/github/roadmap/issues/592 ...
Yes, this is a crucial distinction to make. The fact of the matter is that you have to treat GitHub Actions like a compromised system. Sure, there's not a ton of steps you can take for protecting builds if it's your primary builder, but you can for example not hook up an AWS account with full admin privileges to it (which I've seen more times than I would have like to).
I set up this recently at a new company and did yarn + ncc to build a compiled js out of typescript. It was a bit hairy as a novice, but ended up working fine.
That protects from npm supply chain stuff, but obviously third-party includes like docker/build-push-action are still a risk.
https://github.com/MarkusSintonen/pyreqwest