russell@unturf.com
05f51ff965
Prod previously installed via 'pip install .' (unbounded requirements.py3.txt) plus 'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved external PyPI deps to whatever was latest, unverified. - requirements-prod.in: source (runtime + prod-server deps) - requirements-prod.lock: 55 PyPI pkgs pinned to exact versions + SHA256 (622 hashes) - scripts/strip-vcs-from-lock.py: removes first-party git theme deps (pip can't hash a git repo; themes are integrity-pinned by their own commit SHAs) - install-source-prod: pip install --require-hashes -r requirements-prod.lock, then pip install . to resolve the first-party git themes without re-resolving the hash-pinned PyPI deps - make pins-lock regenerates the lock deliberately Validated locally: stripped lock installs under --require-hashes, app imports under resolved versions (SQLAlchemy 2.0, Pyramid latest).
28 lines
964 B
Python
28 lines
964 B
Python
#!/usr/bin/env python3
|
|
"""Strip VCS (git+) entries from a uv/pip-compile lock file.
|
|
|
|
pip's --require-hashes mode rejects every requirement that lacks a hash, and a
|
|
VCS dependency (git+ssh / git+https) cannot be hashed. Our git-hosted themes are
|
|
first-party repos, integrity-pinned by their own commit SHAs, and install via
|
|
'pip install .' at deploy time — so we remove them from the hash-locked PyPI set.
|
|
|
|
Usage: strip-vcs-from-lock.py requirements-prod.lock
|
|
"""
|
|
import re
|
|
import sys
|
|
|
|
path = sys.argv[1]
|
|
lines = open(path).read().splitlines()
|
|
out, skip, removed = [], False, []
|
|
for ln in lines:
|
|
if skip:
|
|
if ln[:1] in (" ", "\t"): # continuation (# via) of a skipped VCS entry
|
|
continue
|
|
skip = False
|
|
if re.match(r"^\S.*@ git\+", ln):
|
|
removed.append(ln.split(" @ ")[0])
|
|
skip = True
|
|
continue
|
|
out.append(ln)
|
|
open(path, "w").write("\n".join(out) + "\n")
|
|
print("stripped VCS deps:", removed or "(none)")
|