-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Provide pinned requirements to allow for reproducible builds #1391
Conversation
Closing #1369 ,as this PR supersedes it. |
5ca92cd
to
f48c1ac
Compare
|
# Don't try and compare the isolated list with the Python2 version. SAM CLI installers | ||
# all use Python3.6+ and Python2.7 is going EOL | ||
if sys.version_info[0] < 3: | ||
sys.exit(0) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🥇
# full requirement==version is within the isolated list. | ||
installed_pkg = installed_pkg_version.split("==")[0] | ||
# There is a py library we use but due to how we are comparing requirements, we need to handle this as a special case. :( | ||
if installed_pkg not in ("py", "boto3") and base_req.startswith(installed_pkg): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nit: can this be another file (list of ignored deps for fidelity checks)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am going to leave as a tuple instead of a file. This is a temporary solution to make sure builds going forward are deterministic. I want to move us into a tool that does the lockfile for us, which is way better than this script :).
Issue #, if available:
Description of changes:
Checklist:
make pr
passesBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.