feat: Add setting generate_hashes for requirements (#1290) Add the new parameter `generate_hashes` (default True) to `compile_pip_requirements()`, letting the user control whether to put `--hash` entries in the requirements lock file generated. In particular if the generated file is supposed to be used as a constraints file the hashes don't make much sense. Fixes bazelbuild/rules_python#894.
diff --git a/docs/pip.md b/docs/pip.md index 8ad5b69..6b96607 100644 --- a/docs/pip.md +++ b/docs/pip.md
@@ -29,8 +29,8 @@ ## compile_pip_requirements <pre> -compile_pip_requirements(<a href="#compile_pip_requirements-name">name</a>, <a href="#compile_pip_requirements-extra_args">extra_args</a>, <a href="#compile_pip_requirements-extra_deps">extra_deps</a>, <a href="#compile_pip_requirements-py_binary">py_binary</a>, <a href="#compile_pip_requirements-py_test">py_test</a>, <a href="#compile_pip_requirements-requirements_in">requirements_in</a>, - <a href="#compile_pip_requirements-requirements_txt">requirements_txt</a>, <a href="#compile_pip_requirements-requirements_darwin">requirements_darwin</a>, <a href="#compile_pip_requirements-requirements_linux">requirements_linux</a>, +compile_pip_requirements(<a href="#compile_pip_requirements-name">name</a>, <a href="#compile_pip_requirements-extra_args">extra_args</a>, <a href="#compile_pip_requirements-extra_deps">extra_deps</a>, <a href="#compile_pip_requirements-generate_hashes">generate_hashes</a>, <a href="#compile_pip_requirements-py_binary">py_binary</a>, <a href="#compile_pip_requirements-py_test">py_test</a>, + <a href="#compile_pip_requirements-requirements_in">requirements_in</a>, <a href="#compile_pip_requirements-requirements_txt">requirements_txt</a>, <a href="#compile_pip_requirements-requirements_darwin">requirements_darwin</a>, <a href="#compile_pip_requirements-requirements_linux">requirements_linux</a>, <a href="#compile_pip_requirements-requirements_windows">requirements_windows</a>, <a href="#compile_pip_requirements-visibility">visibility</a>, <a href="#compile_pip_requirements-tags">tags</a>, <a href="#compile_pip_requirements-kwargs">kwargs</a>) </pre> @@ -57,6 +57,7 @@ | <a id="compile_pip_requirements-name"></a>name | base name for generated targets, typically "requirements". | none | | <a id="compile_pip_requirements-extra_args"></a>extra_args | passed to pip-compile. | <code>[]</code> | | <a id="compile_pip_requirements-extra_deps"></a>extra_deps | extra dependencies passed to pip-compile. | <code>[]</code> | +| <a id="compile_pip_requirements-generate_hashes"></a>generate_hashes | whether to put hashes in the requirements_txt file. | <code>True</code> | | <a id="compile_pip_requirements-py_binary"></a>py_binary | the py_binary rule to be used. | <code><function py_binary></code> | | <a id="compile_pip_requirements-py_test"></a>py_test | the py_test rule to be used. | <code><function py_test></code> | | <a id="compile_pip_requirements-requirements_in"></a>requirements_in | file expressing desired dependencies. | <code>None</code> |
diff --git a/python/pip_install/requirements.bzl b/python/pip_install/requirements.bzl index 86fd408..84ee203 100644 --- a/python/pip_install/requirements.bzl +++ b/python/pip_install/requirements.bzl
@@ -21,6 +21,7 @@ name, extra_args = [], extra_deps = [], + generate_hashes = True, py_binary = _py_binary, py_test = _py_test, requirements_in = None, @@ -49,6 +50,7 @@ name: base name for generated targets, typically "requirements". extra_args: passed to pip-compile. extra_deps: extra dependencies passed to pip-compile. + generate_hashes: whether to put hashes in the requirements_txt file. py_binary: the py_binary rule to be used. py_test: the py_test rule to be used. requirements_in: file expressing desired dependencies. @@ -88,7 +90,7 @@ loc.format(requirements_darwin) if requirements_darwin else "None", loc.format(requirements_windows) if requirements_windows else "None", "//%s:%s.update" % (native.package_name(), name), - ] + extra_args + ] + (["--generate-hashes"] if generate_hashes else []) + extra_args deps = [ requirement("build"),
diff --git a/python/pip_install/tools/dependency_resolver/dependency_resolver.py b/python/pip_install/tools/dependency_resolver/dependency_resolver.py index ceb20db..e277cf9 100644 --- a/python/pip_install/tools/dependency_resolver/dependency_resolver.py +++ b/python/pip_install/tools/dependency_resolver/dependency_resolver.py
@@ -153,7 +153,6 @@ os.environ["CUSTOM_COMPILE_COMMAND"] = update_command os.environ["PIP_CONFIG_FILE"] = os.getenv("PIP_CONFIG_FILE") or os.devnull - sys.argv.append("--generate-hashes") sys.argv.append("--output-file") sys.argv.append(requirements_file_relative if UPDATE else requirements_out) sys.argv.append(
diff --git a/tests/compile_pip_requirements/BUILD.bazel b/tests/compile_pip_requirements/BUILD.bazel index 87ffe70..ad5ee1a 100644 --- a/tests/compile_pip_requirements/BUILD.bazel +++ b/tests/compile_pip_requirements/BUILD.bazel
@@ -33,6 +33,21 @@ requirements_txt = "requirements_lock.txt", ) +compile_pip_requirements( + name = "requirements_nohashes", + data = [ + "requirements.in", + "requirements_extra.in", + ], + extra_args = [ + "--allow-unsafe", + "--resolver=backtracking", + ], + generate_hashes = False, + requirements_in = "requirements.txt", + requirements_txt = "requirements_nohashes_lock.txt", +) + genrule( name = "generate_os_specific_requirements_in", srcs = [],
diff --git a/tests/compile_pip_requirements/requirements_nohashes_lock.txt b/tests/compile_pip_requirements/requirements_nohashes_lock.txt new file mode 100644 index 0000000..2b08a8e --- /dev/null +++ b/tests/compile_pip_requirements/requirements_nohashes_lock.txt
@@ -0,0 +1,10 @@ +# +# This file is autogenerated by pip-compile with Python 3.9 +# by the following command: +# +# bazel run //:requirements_nohashes.update +# +pip==22.3.1 + # via -r requirements.in +setuptools==65.6.3 + # via -r requirements_extra.in