From 83f37272b31b25a1c87fc6a2dd096a9d09eca421 Mon Sep 17 00:00:00 2001 From: Isis Lovecruft Date: Tue, 3 Dec 2013 00:06:34 +0000 Subject: [PATCH] Pin psutil==1.2.1 and add a SHA-256 hash for peep. See https://pypi.python.org/pypi/peep/ for a pip wrapper which pins packages by hash digest in a requirements.txt file. --- requirements.txt | 61 +++--------------------------------------------- 1 file changed, 3 insertions(+), 58 deletions(-) diff --git a/requirements.txt b/requirements.txt index fc171a9..2b610ba 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,58 +1,3 @@ -# -# python-gnupg/requirements.txt -# ----------------------------- -# Pip requirements.txt file. This file is also parsed for distribute to use in -# setup.py. -#_____________________________________________________________________________ -# This file is part of python-gnupg, a Python interface to GnuPG. -# Copyright © 2013 Isis Lovecruft, 0xA3ADB67A2CDB8B35 -# © 2013 Andrej B. -# © 2013 LEAP Encryption Access Project -# © 2008-2012 Vinay Sajip -# © 2005 Steve Traugott -# © 2004 A.M. Kuchling -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the Free -# Software Foundation, either version 3 of the License, or (at your option) -# any later version. -# -# This program is distributed in the hope that it will be useful, but WITHOUT -# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -# FITNESS FOR A PARTICULAR PURPOSE. See the included LICENSE file for details. -#______________________________________________________________________________ -# -# Force pip upgrade due to security vulnerabilities. -# -# This has actually has little to do with installing python-gnupg, since -# older versions of pip would install everything just fine. except that, in -# my opinion, using GnuPG for privacy is silly when the installation of -# python-gnupg with an older version of pip is trivially exploitable through -# a MITM attack. see https://github.com/pypa/pip/pull/791 -# -# Also, note that SSL package delivery is *not* entirely fixed yet. See -# https://github.com/TheTorProject/ooni-backend/pull/1#discussion_r4084881 -# -#pip>=1.3.1 -# -# NOTE: setuptools is currently (as of 27 May 2013) being merged back into its -# parent project, distribute. By using the included distribute_setup.py -# script, we make sure that we have a recent version of setuptools/distribute, -# which is the *only* Python packaging framework compatible at this point with -# both Python>=2.4 and Python3.x. -# -# A new version of distribute is necessary due to the merging of setuptools -# back into its parent project, distribute. Also, the only way to package for -# both Python 2 and 3 is to use distribute. -# -#distribute>=0.6.45 -# -# Sphinx is only necessary for building documentation, so it is added in -# setup.py under extras_require['docs']. -# -# If you want to build the documentation, uncomment this line: -#Sphinx>=1.1 -# -# And, this one is actually used in the gnupg module code: -# -psutil>=0.5.1 +# sha256: UI5KRMglOjhqD4bZyb1KG0y7L5TojUmhnBUTZTymbEU +psutil==1.2.1 +