Merge pull request #478 from freedomofpress/use-poetry-for-bootstrap

Use poetry for bootstrap

README.md

@@ -26,27 +26,27 @@
     PKG_VERSION=x.y.z ./scripts/update-changelog securedrop-client
     PKG_GITREF=x.y.z make securedrop-client
     ```
-    
+
     ```shell
     # From a non-release tag or branch
     PKG_VERSION=<version> ./scripts/update-changelog securedrop-client
     PKG_GITREF=<ref> make securedrop-client
     ```
-    
+
     ```shell
     # From a source tarball
     # First give the Debian package you want to build a version number by setting it in the changelog
     PKG_VERSION=<version> ./scripts/update-changelog securedrop-client
     PKG_PATH=local/path/to/securedrop-client/dist/securedrop-client-x.y.z.tar.gz make securedrop-client
     ```
-    
+
     ```shell
     # From a local source checkout
     # First give the Debian package you want to build a version number by setting it in the changelog
     PKG_VERSION=<version> ./scripts/update-changelog securedrop-client
     PKG_PATH=local/path/to/securedrop-client make securedrop-client
     ```
-    
+
 ## Which packages can `securedrop-builder` build?
 
 * [securedrop-client](https://github.com/freedomofpress/securedrop-client)
@@ -70,25 +70,25 @@ We use [build](https://pypa-build.readthedocs.io/en/latest/) toolchain to build
 If we have to update the tool, use the following steps
 
 ```shell
-# First create a new fresh virtualenv
-rm -rf .venv && python3 -m venv .venv
+# Ensure you are running in a cleanly boostrapped virtual environment
+rm -rf .venv
+make install-deps
 source .venv/bin/activate
-# Then install pip-tools, from pinned dependencies
-python3 -m pip install -r workstation-bootstrap/requirements.txt
-# Then update the requirements.in file as required
-pip-compile --allow-unsafe --generate-hashes \
-    --output-file=workstation-bootstrap/requirements.txt workstation-bootstrap/requirements.in
-# Now we are ready for bootstrapping
-./scripts/build-sync-wheels --project workstation-bootstrap --pkg-dir ./workstation-bootstrap --requirements .
-# Here we have the new wheels ready
-# Now let us recreate our new sha256sums for bootstrapping
+# Perform the required dependency operations using Poetry.
+# Use "poetry update <foo>" to update an individual dependency per pyproject.toml
+# Use "poetry lock --no-update" to pick up pyproject.toml additions/removals
+# Use -C to run commands in the workstation-bootstrap directory, e.g.:
+poetry -C workstation-bootstrap/ lock --no-update
+# Now we are ready to build updated wheels:
+./scripts/build-sync-wheels --project workstation-bootstrap --pkg-dir ./workstation-bootstrap
+# Once the new wheels are ready, we recreate our sha256sums:
 ./scripts/sync-sha256sums ./workstation-bootstrap
-# now let us sign the list of sha256sums
+# Sign the list of sha256sums
 gpg --armor --output workstation-bootstrap/sha256sums.txt.asc --detach-sig  workstation-bootstrap/sha256sums.txt
 # We can even verify if we want
 ./scripts/verify-sha256sum-signature ./workstation-bootstrap/
 # Update the build-requirements.txt file
-./scripts/update-requirements --pkg-dir ./workstation-bootstrap/ --project workstation-bootstrap --requirements .
+./scripts/update-requirements --pkg-dir ./workstation-bootstrap/ --project workstation-bootstrap
 ```
 
 Make sure that your GPG public key is stored in `pubkeys/`, so CI can verify the signatures.

workstation-bootstrap/build-requirements.txt

@@ -1,15 +1,13 @@
 build==0.3.0 --hash=sha256:3fe8fac398ae76f534dee92c0db01c2960e271094f8cd52aa9d24a633c244e59
-click==8.0.3 --hash=sha256:a9a60804cb76f3a5b4c53ab3c53027f7b00e377d55f05f85855222694f8be790
 cython==0.29.33 --hash=sha256:927f6456a45d2b3e7d57ef0a4a2a6abfe7973d6adad79c0d5a69da5fc0c8ea74 --hash=sha256:067ef67c2876aadc7654b33916d076ef15b162cc6eacee621d8ddc1bd5717cb7
 flit-core==2.3.0 --hash=sha256:a14d6cca50a51eff2c418fc3f8e887cd31a3233a6b465451fd57074e232d7c4c
 packaging==20.9 --hash=sha256:44698376bc57a48290dc82bfdc20d339684856b24d6b8c3760b284de4eebc498
 pep517==0.9.1 --hash=sha256:bfe04a1859fd3cbd3bc2a1ffd2a6dbf30e912bf7fc36ed55d4c838d642c55934
-pip-tools==6.0.1 --hash=sha256:bab8000c26c590c10d33a40cf524cc65df925224c556b429b666b3478158f2b9
+pip==21.3.1 --hash=sha256:6934731b2bc2162636cf88173c73bf2318d78fe5793be14f5d4634a526fdb5c2
 pyparsing==2.4.7 --hash=sha256:4d00a1a6d2bf41a459fa6f47d41a1c5d157715283c2dc4a4b291972037bc9620
 pytest-runner==5.3.0 --hash=sha256:3084ada00452395171c8f10199d2b5d3b74c6948518c2b6bd75e948c77ca2280
 pytoml==0.1.21 --hash=sha256:97e4f6bd5d1d2a32f82d5c6ec9bb90a1b60db3af81b6427ee9a5949021d56d7b
+setuptools==54.0.0 --hash=sha256:d55810b08ce4cef4d4e354e4fc1013c435abf3a9712daa4f48dcfc8694f4722f
 setuptools-scm==5.0.2 --hash=sha256:96d120093688708a75155802077cc3fefd4352b2b5e30386821e86bbc4c8c402
 toml==0.10.2 --hash=sha256:931471fdf4a532e4095922de7eb81ef13da584d91af4f93e2e7284b29f56a65b
 wheel==0.36.2 --hash=sha256:870fcd67bd55da8e73be17468e970d365ad926ac9c5fee0e00ad778019c579d9
-pip==21.3.1 --hash=sha256:6934731b2bc2162636cf88173c73bf2318d78fe5793be14f5d4634a526fdb5c2
-setuptools==54.0.0 --hash=sha256:d55810b08ce4cef4d4e354e4fc1013c435abf3a9712daa4f48dcfc8694f4722f

workstation-bootstrap/pyproject.toml

@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "workstation-bootsrap"
+version = "0.1.0"
+description = "Requirements for building wheels"
+authors = ["SecureDrop Team"]
+license = "GPLv3+"
+readme = "README.md"
+
+[tool.poetry.dependencies]
+python = "^3.9"
+build = "0.3.0"
+wheel = "0.36.2"
+pip = "21.3.1"
+setuptools-scm = "5.0.2"
+pytest-runner = "5.3.0"
+cython = "0.29.33"
+flit-core = "2.3.0"