5 commits

Author	SHA1	Message	Date
Cursor Agent	5267cc9cab	docs: AI/GPU image comparison — CUDA ships in wheels (~98% of image); one-dep bump re-uploads ~11MB vs ~2.9GB for a uv sync Dockerfile ... Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>	2026-06-11 02:17:01 +00:00
Cursor Agent	971e955c35	wheelhouse: don't build sdists; fail fast and direct to --find-links pre-built wheels ... Building sdists runs dependency build code on the host (RCE surface, no sandbox), is non-hermetic/non-reproducible, needs a toolchain, and is host-arch-only for compiled packages -- all at odds with pymage's guarantees. Remove the builder and --build-sdists opt-in; keep sdist parsing only so the error can explain the package is sdist-only and point at the --find-links pre-build workflow. Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>	2026-06-11 01:50:41 +00:00
Cursor Agent	bf565be0ce	docs: document sdists as opt-in with security (host RCE) and single-arch caveats ... Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>	2026-06-11 01:42:12 +00:00
Cursor Agent	5f7012b8c9	docs: document sdist building, --extra/--package, marker eval, base OS-package requirement, and incremental-rebuild comparison ... Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>	2026-06-11 01:32:56 +00:00
Cursor Agent	b484b02113	docs: real-world comparison study (uv Dockerfiles vs pymage) + migration gaps ... Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>	2026-06-11 01:05:27 +00:00