mirror of
https://github.com/certbot/certbot.git
synced 2026-08-01 16:19:13 +02:00
Finish pinning system rewrite (#8934)
* add oldest pyproject.toml file that works * make single oldest_constraints.txt file * remove unused merge_requirements.py * remove unused import * make conditional right * simplify pip_install.py * fix typo * bump min dns-lexicon dependency * fix zope import warning * pin back wheel * refactor pinning script * Add oldest script. * add pip comment * add pipstrap extra * simplify pinning scripts * remove pipstrap extra * update contributing * Add design doc * Update tools/pinning/DESIGN.md Co-authored-by: ohemorange <erica@eff.org> * Update tools/pinning/DESIGN.md Co-authored-by: ohemorange <erica@eff.org> * Update tools/pinning/DESIGN.md Co-authored-by: ohemorange <erica@eff.org> * Update tools/pinning/DESIGN.md Co-authored-by: ohemorange <erica@eff.org> * rename normal to current * no dummies * script improvements * mention need to update setup.py * try and clarify poetry behavior * tweak section title Co-authored-by: ohemorange <erica@eff.org>
This commit is contained in:
Brad Warren
co-authored by
ohemorange
ohemorange
parent
10eecf9c97
commit
08839758bd
@@ -0,0 +1,145 @@
|
||||
[tool.poetry]
|
||||
name = "certbot-pinner"
|
||||
version = "0.1.0"
|
||||
description = "A simple project for pinning Certbot's dependencies using Poetry."
|
||||
authors = ["Certbot Project"]
|
||||
license = "Apache License 2.0"
|
||||
|
||||
[tool.poetry.dependencies]
|
||||
# The Python version here should be kept in sync with the one used in our
|
||||
# oldest tests in tox.ini.
|
||||
python = "3.6"
|
||||
|
||||
# Local dependencies
|
||||
# Any local packages that have dependencies on other local packages must be
|
||||
# listed below before the package it depends on. For instance, certbot depends
|
||||
# on acme so certbot must be listed before acme.
|
||||
certbot-ci = {path = "../../../certbot-ci"}
|
||||
certbot-dns-cloudflare = {path = "../../../certbot-dns-cloudflare"}
|
||||
certbot-dns-cloudxns = {path = "../../../certbot-dns-cloudxns"}
|
||||
certbot-dns-digitalocean = {path = "../../../certbot-dns-digitalocean"}
|
||||
certbot-dns-dnsimple = {path = "../../../certbot-dns-dnsimple"}
|
||||
certbot-dns-dnsmadeeasy = {path = "../../../certbot-dns-dnsmadeeasy"}
|
||||
certbot-dns-gehirn = {path = "../../../certbot-dns-gehirn"}
|
||||
certbot-dns-google = {path = "../../../certbot-dns-google"}
|
||||
certbot-dns-linode = {path = "../../../certbot-dns-linode"}
|
||||
certbot-dns-luadns = {path = "../../../certbot-dns-luadns"}
|
||||
certbot-dns-nsone = {path = "../../../certbot-dns-nsone"}
|
||||
certbot-dns-ovh = {path = "../../../certbot-dns-ovh"}
|
||||
certbot-dns-rfc2136 = {path = "../../../certbot-dns-rfc2136"}
|
||||
certbot-dns-route53 = {path = "../../../certbot-dns-route53"}
|
||||
certbot-dns-sakuracloud = {path = "../../../certbot-dns-sakuracloud"}
|
||||
certbot-nginx = {path = "../../../certbot-nginx"}
|
||||
certbot-apache = {path = "../../../certbot-apache", extras = ["dev"]}
|
||||
certbot = {path = "../../../certbot", extras = ["test"]}
|
||||
acme = {path = "../../../acme", extras = ["test"]}
|
||||
|
||||
# Oldest dependencies
|
||||
# We specify the oldest versions our dependencies that we're trying to keep
|
||||
# support for below. Usually these version numbers are taken from the packages
|
||||
# of our dependencies available in popular LTS Linux distros. Keeping
|
||||
# compatibility with those versions makes it much easier for OS maintainers to
|
||||
# update their Certbot packages.
|
||||
#
|
||||
# When updating these dependencies, we should ideally try to only update them
|
||||
# to the oldest version of the dependency that is found in a non-EOL'd version
|
||||
# of CentOS, Debian, or Ubuntu that has Certbot packages in their OS
|
||||
# repositories using a version of Python we support. If the distro is EOL'd or
|
||||
# using a version of Python we don't support, it can be ignored. If the
|
||||
# dependency being updated is a direct dependency of one of our own packages,
|
||||
# the minimum required version of that dependency should be updated in our
|
||||
# setup.py files as well to communicate this information to our users.
|
||||
|
||||
# CentOS/RHEL 7 EPEL dependencies
|
||||
# Some of these dependencies may be stricter than necessary because they
|
||||
# initially referred to the Python 2 packages in CentOS/RHEL 7 with EPEL.
|
||||
cffi = "1.9.1"
|
||||
chardet = "2.2.1"
|
||||
ipaddress = "1.0.16"
|
||||
mock = "1.0.1"
|
||||
ndg-httpsclient = "0.3.2"
|
||||
ply = "3.4"
|
||||
pyOpenSSL = "17.3.0"
|
||||
pyasn1 = "0.1.9"
|
||||
pycparser = "2.14"
|
||||
pyRFC3339 = "1.0"
|
||||
python-augeas = "0.5.0"
|
||||
oauth2client = "4.0.0"
|
||||
requests = "2.14.2"
|
||||
urllib3 = "1.10.2"
|
||||
# Package names containing "." need to be quoted.
|
||||
"zope.component" = "4.1.0"
|
||||
"zope.event" = "4.0.3"
|
||||
"zope.interface" = "4.0.5"
|
||||
|
||||
# Debian Jessie Backports dependencies
|
||||
# Debian Jessie has reached end of life so these dependencies can probably be
|
||||
# updated as needed or desired.
|
||||
pbr = "1.8.0"
|
||||
pytz = "2012rc0"
|
||||
|
||||
# Debian Buster dependencies
|
||||
google-api-python-client = "1.5.5"
|
||||
pyparsing = "2.2.0"
|
||||
|
||||
# Our setup.py dependencies
|
||||
apacheconfig = "0.3.2"
|
||||
cloudflare = "1.5.1"
|
||||
python-digitalocean = "1.11"
|
||||
|
||||
# Ubuntu Xenial dependencies
|
||||
# Ubuntu Xenial only has versions of Python which we do not support available
|
||||
# so these dependencies can probably be updated as needed or desired.
|
||||
ConfigArgParse = "0.10.0"
|
||||
funcsigs = "0.4"
|
||||
# Package names containing "." need to be quoted.
|
||||
"zope.hookable" = "4.0.4"
|
||||
|
||||
# Ubuntu Bionic dependencies.
|
||||
cryptography = "2.1.4"
|
||||
distro = "1.0.1"
|
||||
httplib2 = "0.9.2"
|
||||
idna = "2.6"
|
||||
setuptools = "39.0.1"
|
||||
six = "1.11.0"
|
||||
|
||||
# Ubuntu Focal dependencies
|
||||
asn1crypto = "0.24.0"
|
||||
configobj = "5.0.6"
|
||||
parsedatetime = "2.4"
|
||||
|
||||
# Plugin dependencies
|
||||
# These aren't necessarily the oldest versions we need to support
|
||||
# Tracking at https://github.com/certbot/certbot/issues/6473
|
||||
boto3 = "1.4.7"
|
||||
botocore = "1.7.41"
|
||||
dns-lexicon = "3.2.1"
|
||||
|
||||
# Build dependencies
|
||||
# Since there doesn't appear to
|
||||
# doesn't appear to be a good way to automatically track down and pin build
|
||||
# dependencies in Python (see
|
||||
# https://discuss.python.org/t/how-to-pin-build-dependencies/8238), we list any
|
||||
# build dependencies here to ensure they're pinned for extra stability.
|
||||
|
||||
# cython is a build dependency of pyyaml
|
||||
cython = "*"
|
||||
|
||||
# Other dependencies
|
||||
# We add any dependencies that must be specified in this file for any another
|
||||
# reason below.
|
||||
|
||||
# pip's new dependency resolver fails on local packages that depend on each
|
||||
# other when those packages are requested with extras such as 'certbot[dev]' so
|
||||
# let's pin it back for now. See https://github.com/pypa/pip/issues/9204.
|
||||
pip = "20.2.4"
|
||||
|
||||
# wheel 0.34.1+ does not support the version of setuptools pinned above (and
|
||||
# wheel 0.34.0 is buggy).
|
||||
wheel = "<0.34.0"
|
||||
|
||||
[tool.poetry.dev-dependencies]
|
||||
|
||||
[build-system]
|
||||
requires = ["poetry-core>=1.0.0"]
|
||||
build-backend = "poetry.core.masonry.api"
|
||||
Executable
+19
@@ -0,0 +1,19 @@
|
||||
#!/bin/bash
|
||||
# This script accepts no arguments and automates the process of updating
|
||||
# Certbot's dependencies including automatically updating the correct file.
|
||||
# Dependencies can be pinned to older versions by modifying pyproject.toml in
|
||||
# the same directory as this file.
|
||||
set -euo pipefail
|
||||
|
||||
WORK_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
|
||||
COMMON_DIR="$(dirname "${WORK_DIR}")/common"
|
||||
REPO_ROOT="$(git rev-parse --show-toplevel)"
|
||||
RELATIVE_SCRIPT_PATH="$(realpath --relative-to "$REPO_ROOT" "$WORK_DIR")/$(basename "${BASH_SOURCE[0]}")"
|
||||
CONSTRAINTS_FILE="$REPO_ROOT/tools/oldest_constraints.txt"
|
||||
|
||||
PINNINGS=$("${COMMON_DIR}/export-pinned-dependencies.sh" "${WORK_DIR}")
|
||||
cat << EOF > "$CONSTRAINTS_FILE"
|
||||
# This file was generated by $RELATIVE_SCRIPT_PATH and can be updated using
|
||||
# that script.
|
||||
EOF
|
||||
echo "${PINNINGS}" >> "${CONSTRAINTS_FILE}"
|
||||
Reference in New Issue
Block a user