freedomofpress / securethenews

An automated scanner and web dashboard for tracking TLS deployment across news organizations
https://securethe.news
GNU Affero General Public License v3.0
102 stars 25 forks source link

Get pip update make targets running again #228

Closed maeve-fpf closed 4 years ago

maeve-fpf commented 4 years ago

This cleans up the Makefile targets that update {dev-,}requirements.txt, and:

Without this, for reasons I don't entirely understand, pip install installs from dev-requirements.txt fine, but attempting to run any pip-compile step fails; logs from running manually in a container here: https://gist.github.com/maeve-fpf/a55248dcbf8420b0542c114f92beca1a

I suspect it may be related to the fact that if you pulled an official python docker image a long time ago, it'd have pip 19, but if you pull one now, it's on pip 20.

maeve-fpf commented 4 years ago

Testing note: please make sure you've pulled any python docker images that you have locally. make compile-pip-dependencies should no longer crash.

maeve-fpf commented 4 years ago

Updated this to take pip-tools out of dev-requirements.in, ran a hash update, fixed another probable typo.

My thinking is that since we're not doing anything to keep python:3.5-slim at a particular hash, it's pip version will continue to be upgraded, and if we pin pip-tools to a particular version, we could get in the same situation again where they are not compatible. Is that reasonable?

chigby commented 4 years ago

That makes a lot of sense to me. Thanks for recompiling the requirements (and fixing that other error), I'm going to merge this, now.