Can the boto dependency be made more explicit

With the new pip dependency resolver introducing the idea of 'backtracking' in order to resolve dependencies in an environment, we are noticing very long installation times for this python package because of the boto3~=1.4 requirement.

To reproduce what I'm talking about, create a new virtual environment (I'm using anaconda below), make sure pip is up to date, install the latest boto3 package, then try installing this package.

conda create -n temp-py 'python>=3.8'
conda activate temp-py
python -m pip install --upgrade pip
pip install boto3
pip install cumulus-process

The behavior I see is pip will tell me:

INFO: pip is looking at multiple versions of botocore to determine which version is compatible with other requirements. This could take a while.

And it ends up 'backtracking' all the way to version 1.4 of boto3 before resolving. I've seen a few examples where it never resolves and just gives an error.

I think this could be resolved by being more specific about which version of boto3 is required; I think ideally the project should be converted to use something like a pipfile and pipfile.lock to specify exact versions of libraries it is intended to be built against.

nasa / cumulus-process-py

Can the boto dependency be made more explicit #136