|
|
05f51ff965
|
supply-chain: hash-pin prod PyPI dependencies (requirements-prod.lock)
Prod previously installed via 'pip install .' (unbounded requirements.py3.txt) plus
'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved external
PyPI deps to whatever was latest, unverified.
- requirements-prod.in: source (runtime + prod-server deps)
- requirements-prod.lock: 55 PyPI pkgs pinned to exact versions + SHA256 (622 hashes)
- scripts/strip-vcs-from-lock.py: removes first-party git theme deps (pip can't hash
a git repo; themes are integrity-pinned by their own commit SHAs)
- install-source-prod: pip install --require-hashes -r requirements-prod.lock, then
pip install . to resolve the first-party git themes without re-resolving the
hash-pinned PyPI deps
- make pins-lock regenerates the lock deliberately
Validated locally: stripped lock installs under --require-hashes, app imports under
resolved versions (SQLAlchemy 2.0, Pyramid latest).
|
2026-05-21 09:22:21 -04:00 |
|
