Pass the only-binary option with the value all, and pip refuses every source distribution. Any package that has no wheel for your platform fails to install. That removes build-time code execution from the install step, but it does not verify who made the wheel, so pair it with hash checking.
The command
python -m pip install --only-binary :all: -r requirements.txt
The pip reference describes the option as "Do not use source packages", and says packages without binary distributions will fail to install when it is used. You can also set it per package, with names separated by commas, or through the PIP_ONLY_BINARY environment variable.
The pip secure installs guide lists this as one of two steps for a safer install. The guide notes that by default pip does not check for remote tampering and involves running arbitrary code from distributions. Source builds are where that arbitrary code lives, because building a sdist runs the project's build backend.
What it does and does not change
| Question | With only-binary all |
|---|---|
| Does pip run a project's build backend? | Not for installs, because it will not build |
| Does it stop a malicious wheel? | No |
| Does it check hashes? | No, that is a separate mode |
| Will every dependency install? | No, some have no wheel |
A wheel is a built archive that pip unpacks. That is a smaller surface than building from source, but a wheel can still contain code that runs when your program imports it. Treat the option as one control, not a verdict on safety. For background see what is inside a sdist and a wheel.
Handling the packages that fail
Failures usually mean one of three things: no wheel exists for your Python version or platform, the project only ships a sdist, or you are on an unusual architecture. Decide per case.
- Check for a newer release that publishes wheels for your platform.
- Allow an exception by name. Use the no-binary option for that one package only, and review its build requirements first.
- Build the wheel once, in a controlled place. The pip wheel command builds wheels into a directory, and the repeatable installs guide shows how to bundle them as a wheelhouse for later offline installs.
- Replace the dependency if it is unmaintained.
An exception list should be short and written down, with an owner and a review date. Each entry is a place where build code still runs.
Add hashes so the wheel is the one you reviewed
Only-binary controls the format. Hash-checking mode controls the exact file. In hash-checking mode, pip requires a local sha256 for every requirement, and the guide says it protects against remote tampering. A wheel and its sdist have different hashes, so include the ones you intend to allow. See how pip hash checking works.
Safeguard's dependency scanning reads Python projects and can enforce policies at the pull request, so an unexpected new dependency can be caught before it reaches your install step. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does only-binary make installs safe?
No. It removes source builds from the install, but it does not check who published a wheel. Use hashes and review new dependencies.
Can I allow source builds for one package only?
Yes. The no-binary option accepts package names, so you can permit a single exception and keep the rest wheel only.
Sources
- pip documentation, Secure installs
- pip documentation, pip install reference
- pip documentation, Repeatable installs
Last reviewed: 19 October 2026.
