Many packages have abused the executable nature of setup.py files by importing obscure packages or adding otherwise fragile logic. I would hate to see Pipfiles go the same way.
Strong +1 to making it a declarative format like YAML or TOML instead of something executable.
Why do you prefer using ``pip`` despite ``pip install`` using the package's ``setup.py`` (and therefore is an eval)?
Further, if you're using a package manager, I expect you won't be combing through the source to check for malicious code anyway.
This is also why wheels (the new python package format) use a static file instead of setup.py. The Python ecosystem has been trying to get off of "just eval setup.py" for years.
You have just ignored the point that your parent point was making. It's not the install case that they were complaining about.