Merge pull request #1792 from freedomofpress/build-require-hashes

Use --require-hashes when installing requirements.txt
freedomofpress · Feb 6, 2024 · 7bdf76e · 7bdf76e
2 parents 79d34b1 + 62dc60e
commit 7bdf76e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/debian/setup-venv.sh b/debian/setup-venv.sh
@@ -11,7 +11,8 @@ WHEELS_DIR="/builder/securedrop-${NAME}/wheels"
 PIP_ARGS="--ignore-installed --no-index --find-links ${WHEELS_DIR} --no-deps --no-cache-dir --no-use-pep517"
 
 /usr/bin/python3 -m virtualenv $VENV_ARGS ./debian/securedrop-${NAME}/opt/venvs/securedrop-${NAME}
-./debian/securedrop-${NAME}/opt/venvs/securedrop-${NAME}/bin/pip install $PIP_ARGS -r ${NAME}/build-requirements.txt
+./debian/securedrop-${NAME}/opt/venvs/securedrop-${NAME}/bin/pip install $PIP_ARGS --require-hashes \
+    -r ${NAME}/build-requirements.txt
 ./debian/securedrop-${NAME}/opt/venvs/securedrop-${NAME}/bin/pip install $PIP_ARGS ./${NAME}
 
 # Adjust paths to reflect installed paths