anchore / anchore-engine

A service that analyzes docker images and scans for vulnerabilities
Apache License 2.0
1.58k stars 273 forks source link

Use pip-tools for requirements management #1308

Closed subecho closed 2 years ago

subecho commented 2 years ago

Before, when a new package or updated version was needed for Engine, we would have to manually update requirements.txt and ensure that any required version bumps were taken care of manually.

With this patch, we can rely on pip-tools and its two commands: pip-compile and pip-sync to automatically generate our requirements files from our new .in files. The biggest advantage of this is that the requirements files are set in stone (i.e. all versions are set with ==) and ensures that all dependencies are enumerated and that appropriate versions are installed.

The README was also updated with steps on how to setup a virtual environment with the pip-tools package and how to update those packages when needed.