Skip to content

Commit

Permalink
Don't install setuptools-scm==6.0.1 via override_dh_autoinstall
Browse files Browse the repository at this point in the history
setuptools-scm 6.0.1 has an unbounded setuptools build dependency, that has
started to pull in a breaking version of setuptools. As far as i can tell, package
wheel builds aren't using it anyway - build isolation means they pull in their
ownn versions of everything. So we can just not install it.

AFAICT this doesn't affect the current state (lack) of build reproducibility. Any
improvements there would probably mean building and using our own wheels following
the same pattern as securedrop-builder&securedrop-client
  • Loading branch information
zenmonkeykstop committed May 25, 2024
1 parent 671c99c commit 724abeb
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions securedrop/debian/rules
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,6 @@ override_dh_auto_install:
python3 /srv/redwood/build-wheel.py --release --redwood /srv/redwood --target /srv/redwood/target
# Set up virtualenv and install dependencies
/usr/bin/python3 -m venv ./debian/securedrop-app-code/opt/venvs/securedrop-app-code
./debian/securedrop-app-code/opt/venvs/securedrop-app-code/bin/pip install $(PIP_ARGS) \
setuptools-scm==6.0.1
./debian/securedrop-app-code/opt/venvs/securedrop-app-code/bin/pip install $(PIP_ARGS) \
pip==21.3
./debian/securedrop-app-code/opt/venvs/securedrop-app-code/bin/pip install $(PIP_ARGS) \
Expand Down

0 comments on commit 724abeb

Please sign in to comment.