Speed up update-python3-dependencies

The `make update-python3-dependencies` step is slow for two main
reasons: container image layering and pip-compile.

Switch to the new uv tool, which reimplements pip-compile in a much
faster way. The output is basically the same, except the sorting is
smarter (e.g. pytest comes before pytest-cov) and package names are
properly normalized. We can also drop the `--allow-unsafe` because uv is
entirely independent of setuptools and pip-tools.

Because uv is independent of the system Python (it's pure Rust), we can
run it on the host and outside the container, so no image rebuilding
happens during the updates, it'll just be needed once afterwards.

uv is still quite new to the Python ecosystem, but this allows us to
begin using it without any lock-in, it should be trivial to swap back to
pip-tools if needed.

Overall `make update-python3-dependencies` now takes seconds to run
instead of minutes \o/

Refs <freedomofpress/securedrop-tooling#16>.

Makefile

@@ -29,27 +29,7 @@ update-admin-pip-requirements:  ## Update admin requirements.
 .PHONY: update-python3-requirements
 update-python3-requirements:  ## Update Python 3 requirements with pip-compile.
 	@echo "███ Updating Python 3 requirements files..."
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/develop-requirements.txt \
-		requirements/python3/translation-requirements.in \
-		requirements/python3/develop-requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/test-requirements.txt \
-		requirements/python3/test-requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-				--allow-unsafe \
-		--output-file requirements/python3/requirements.txt \
-		requirements/python3/requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/bootstrap-requirements.txt \
-		requirements/python3/bootstrap-requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/translation-requirements.txt \
-		requirements/python3/translation-requirements.in
+	@$(SDBIN)/update-requirements
 
 .PHONY: update-pip-requirements
 update-pip-requirements: update-admin-pip-requirements update-python3-requirements ## Update all requirements with pip-compile.

securedrop/bin/update-requirements

@@ -0,0 +1,24 @@
+#!/bin/bash
+# shellcheck disable=SC2086
+set -euxo pipefail
+
+COMMON_ARGS="--generate-hashes --python-version 3.8 --python-platform x86_64-unknown-linux-gnu --custom-compile-command ./securedrop/bin/update-requirements"
+
+cd "$(git rev-parse --show-toplevel)/securedrop"
+
+uv pip compile ${COMMON_ARGS} \
+    --output-file requirements/python3/develop-requirements.txt \
+    requirements/python3/translation-requirements.in \
+    requirements/python3/develop-requirements.in
+uv pip compile ${COMMON_ARGS} \
+    --output-file requirements/python3/test-requirements.txt \
+    requirements/python3/test-requirements.in
+uv pip compile ${COMMON_ARGS} \
+    --output-file requirements/python3/requirements.txt \
+    requirements/python3/requirements.in
+uv pip compile ${COMMON_ARGS} \
+    --output-file requirements/python3/bootstrap-requirements.txt \
+    requirements/python3/bootstrap-requirements.in
+uv pip compile ${COMMON_ARGS} \
+    --output-file requirements/python3/translation-requirements.txt \
+    requirements/python3/translation-requirements.in

securedrop/requirements/python3/bootstrap-requirements.txt

@@ -1,13 +1,19 @@
-#
-# This file is autogenerated by pip-compile
-# To update, run:
-#
-#    pip-compile --allow-unsafe --generate-hashes --output-file=requirements/python3/bootstrap-requirements.txt requirements/python3/bootstrap-requirements.in
-#
+# This file was autogenerated by uv via the following command:
+#    ./securedrop/bin/update-requirements
 packaging==24.1 \
     --hash=sha256:026ed72c8ed3fcce5bf8950572258698927fd1dbda10a5e981cdf0ac37f4f002 \
     --hash=sha256:5b8f2217dbdbd2f7f384c41c628544e6d52f2d0f53c6d0c3ea61aa5d1d7ff124
     # via setuptools-scm
+pip==21.3 \
+    --hash=sha256:4a1de8f97884ecfc10b48fe61c234f7e7dcf4490a37217011ad9369d899ad5a6 \
+    --hash=sha256:741a61baab1dbce2d8ca415effa48a2b6a964564f81a9f4f1fce4c433346c034
+    # via -r requirements/python3/bootstrap-requirements.in
+setuptools==70.3.0 \
+    --hash=sha256:f171bab1dfbc86b132997f26a119f6056a57950d058587841a0082e8830f9dc5 \
+    --hash=sha256:fe384da74336c398e0d956d1cae0669bc02eed936cdb1d49b57de1990dc11ffc
+    # via
+    #   -r requirements/python3/bootstrap-requirements.in
+    #   setuptools-scm
 setuptools-scm==8.1.0 \
     --hash=sha256:42dea1b65771cba93b7a515d65a65d8246e560768a66b9106a592c8e7f26c8a7 \
     --hash=sha256:897a3226a6fd4a6eb2f068745e49733261a21f70b1bb28fce0339feb978d9af3
@@ -24,15 +30,3 @@ wheel==0.38.4 \
     --hash=sha256:965f5259b566725405b05e7cf774052044b1ed30119b5d586b2703aafe8719ac \
     --hash=sha256:b60533f3f5d530e971d6737ca6d58681ee434818fab630c83a734bb10c083ce8
     # via -r requirements/python3/bootstrap-requirements.in
-
-# The following packages are considered to be unsafe in a requirements file:
-pip==21.3 \
-    --hash=sha256:4a1de8f97884ecfc10b48fe61c234f7e7dcf4490a37217011ad9369d899ad5a6 \
-    --hash=sha256:741a61baab1dbce2d8ca415effa48a2b6a964564f81a9f4f1fce4c433346c034
-    # via -r requirements/python3/bootstrap-requirements.in
-setuptools==70.3.0 \
-    --hash=sha256:f171bab1dfbc86b132997f26a119f6056a57950d058587841a0082e8830f9dc5 \
-    --hash=sha256:fe384da74336c398e0d956d1cae0669bc02eed936cdb1d49b57de1990dc11ffc
-    # via
-    #   -r requirements/python3/bootstrap-requirements.in
-    #   setuptools-scm

securedrop/requirements/python3/develop-requirements.in

@@ -18,9 +18,7 @@ molecule-vagrant==0.3
 # Needed for ansible network filter
 # http://docs.ansible.com/ansible/latest/playbooks_filters_ipaddr.html
 netaddr
-# Now also pin pip due to https://github.com/jazzband/pip-tools/issues/853
-pip>=21.3
-pip-tools>=6.1.0
+pip
 polib
 prompt_toolkit==2.0.9
 psutil>=5.6.6
@@ -43,4 +41,5 @@ six==1.15.0
 testinfra>=5.3.1
 translate-toolkit
 urllib3>=1.26.5
+uv
 yamllint