Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Provide pinned requirements to allow for reproducible builds #1391

Merged
merged 3 commits into from
Sep 10, 2019

Conversation

jfuss
Copy link
Contributor

@jfuss jfuss commented Aug 30, 2019

Issue #, if available:

Description of changes:

Checklist:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@sriram-mv
Copy link
Contributor

Closing #1369 ,as this PR supersedes it.

@sriram-mv sriram-mv mentioned this pull request Sep 3, 2019
6 tasks
@jfuss jfuss force-pushed the support/isoloated-builds branch from 5ca92cd to f48c1ac Compare September 5, 2019 18:04
@jfuss
Copy link
Contributor Author

jfuss commented Sep 5, 2019

boto3 is going to be a pain in this model since it is released so often. For now, I am going to add a lesser check on boto3 in our checking script. I am basically re-implementing how a .lock file works and time is better spent moving over to a tool that does that for us but doing this in the short term seems ok.

# Don't try and compare the isolated list with the Python2 version. SAM CLI installers
# all use Python3.6+ and Python2.7 is going EOL
if sys.version_info[0] < 3:
sys.exit(0)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥇

# full requirement==version is within the isolated list.
installed_pkg = installed_pkg_version.split("==")[0]
# There is a py library we use but due to how we are comparing requirements, we need to handle this as a special case. :(
if installed_pkg not in ("py", "boto3") and base_req.startswith(installed_pkg):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: can this be another file (list of ignored deps for fidelity checks)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am going to leave as a tuple instead of a file. This is a temporary solution to make sure builds going forward are deterministic. I want to move us into a tool that does the lockfile for us, which is way better than this script :).

@jfuss jfuss merged commit 2a55807 into aws:develop Sep 10, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants