russell@unturf.com
05f51ff965
Prod previously installed via 'pip install .' (unbounded requirements.py3.txt) plus 'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved external PyPI deps to whatever was latest, unverified. - requirements-prod.in: source (runtime + prod-server deps) - requirements-prod.lock: 55 PyPI pkgs pinned to exact versions + SHA256 (622 hashes) - scripts/strip-vcs-from-lock.py: removes first-party git theme deps (pip can't hash a git repo; themes are integrity-pinned by their own commit SHAs) - install-source-prod: pip install --require-hashes -r requirements-prod.lock, then pip install . to resolve the first-party git themes without re-resolving the hash-pinned PyPI deps - make pins-lock regenerates the lock deliberately Validated locally: stripped lock installs under --require-hashes, app imports under resolved versions (SQLAlchemy 2.0, Pyramid latest). |
||
|---|---|---|
| .. | ||
| spam | ||
| promote_superuser.py | ||
| strip-vcs-from-lock.py | ||