russell@unturf.com
05f51ff965
Prod previously installed via 'pip install .' (unbounded requirements.py3.txt) plus 'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved external PyPI deps to whatever was latest, unverified. - requirements-prod.in: source (runtime + prod-server deps) - requirements-prod.lock: 55 PyPI pkgs pinned to exact versions + SHA256 (622 hashes) - scripts/strip-vcs-from-lock.py: removes first-party git theme deps (pip can't hash a git repo; themes are integrity-pinned by their own commit SHAs) - install-source-prod: pip install --require-hashes -r requirements-prod.lock, then pip install . to resolve the first-party git themes without re-resolving the hash-pinned PyPI deps - make pins-lock regenerates the lock deliberately Validated locally: stripped lock installs under --require-hashes, app imports under resolved versions (SQLAlchemy 2.0, Pyramid latest).
7 lines
413 B
Text
7 lines
413 B
Text
# Source for the hash-locked prod requirements (requirements-prod.lock).
|
|
# Combines runtime deps (setup.py install_requires reads requirements.py3.txt)
|
|
# with prod server deps. VCS theme deps (git+ssh) are stripped post-compile —
|
|
# pip cannot hash a git repo; themes install via 'pip install .' (SHA-pinned by
|
|
# their own repos). Regenerate with: make pins-lock
|
|
-r requirements.py3.txt
|
|
-r requirements-prod.txt
|