Support Hashed Requirements Across Multiple OSen

[ghickman]

We currently have pip-compile set up to created hashed requirements files, which pip installs with --require-hashes by default when it finds --hash lines in a requirements file.

The requirements files pip-compile creates are OS-specific, that is to say it will resolve the dependency tree using the current OS. At install-time pip will find any missing requirements and error because there are no hashes for them. We've seen this with pytest's windows-only dependency atomicwrites. This correctly fails CI.

Potential options (add/delete as necessary):

• generate a windows requirements file with missing dependencies in CI

[StevenMaude]

Relevant pip-tools issue: https://github.com/jazzband/pip-tools/issues/826

There's a relevant draft PEP.

Switching to uv could also solve this problem; #263.