russell@unturf.com
7c4959946b
Prod previously installed via 'pip install .' (reads unbounded requirements.py3.txt) plus 'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved to whatever PyPI served, unverified. A poisoned release of any dep (stripe, boto3, sqlalchemy, pyramid...) would land in a payment app. - requirements-prod.in: source (runtime + prod-server deps) - requirements-prod.lock: 68 pkgs pinned to exact versions + SHA256 (854 hashes), generated with uv pip compile --generate-hashes - install-source-prod now: pip install --require-hashes -r requirements-prod.lock then pip install --no-deps . — no floating resolve at deploy time - make pins-lock regenerates the lock deliberately Validated locally: lock installs under --require-hashes, app imports, 791 logic tests pass under resolved versions (functional tests need MPS_TEST_* env, gated in CI).
6 lines
343 B
Text
6 lines
343 B
Text
# Source for the hash-locked prod requirements (requirements-prod.lock).
|
|
# Combines runtime deps (setup.py install_requires reads requirements.py3.txt)
|
|
# with prod server deps. Regenerate the lock with:
|
|
# pip-compile --generate-hashes --upgrade -o requirements-prod.lock requirements-prod.in
|
|
-r requirements.py3.txt
|
|
-r requirements-prod.txt
|