Installing packges from requirements.txt complains about require-hashes and some packages not having their versions pinned
See original GitHub issuepip install -r requirements.txt
using the file generated by pipenv lock -r
complains about some packages not having their version pinned with ==
. Among them, setuptools
and six
.
It may be related to #1417
Describe your environment
- OS Type: MacOS 10.12.6 (with MacPorts)
- Python version:
3.6.4
- Pipenv version:
9.1.0
(installed from master, on Feb, 18th)
Expected result
I expected the all packages being installed in the target
directory with versions coherent with Pipfile.lock
Actual result
In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
setuptools>=0.6b1 from https://pypi.python.org/packages/43/41/033a273f9a25cb63050a390ee8397acbc7eae2159195d85f06f17e7be45a/setuptools-38.5.1-py2.py3-none-any.whl#md5=908b8b5e50bf429e520b2b5fa1b350e5 (from injector==0.13.4->-r target/requirements.txt (line 5))
six from https://pypi.python.org/packages/67/4b/141a581104b1f6397bfa78ac9d43d8ad29a7ca43ea90a2d863fe3056e86a/six-1.11.0-py2.py3-none-any.whl#md5=866ab722be6bdfed6830f3179af65468 (from purl==1.3.1->-r target/requirements.txt (line 6))
Steps to replicate
With this Pipfile
[[source]]
url = "https://pypi.python.org/simple"
verify_ssl = true
name = "pypi"
[packages]
purl = "*"
requests = "*"
python-dotenv = "*"
injector = "*"
voluptuous = "*"
[dev-packages]
"boto3" = "*"
pytest = "*"
pytest-mock = "*"
selenium = "*"
bpython = "*"
Commands
mkdir target
pipenv lock -r > target/requirements.txt
# with pip executed from a shell created with pipenv shell or from a new one
pip install -r target/requirements.txt -t target
Issue Analytics
- State:
- Created 6 years ago
- Reactions:4
- Comments:9 (2 by maintainers)
Top Results From Across the Web
Constraints files with hashes - Discussions on Python.org
txt I then get an error when I do pip install : ERROR: In --require-hashes mode, all requirements must have their versions pinned...
Read more >python - How to check which dependency requires hashes?
When any of your packages includes a hash in your requirements.txt , pip will automatically use the --require-hashes flag when installing ...
Read more >Setuptools version not pinned in certbot - bug? - Client dev
I am installing certbot through a standard pip install based on a requirements.txt file exported by poetry , in a standard python docker ......
Read more >Specifying dependencies using a requirements file
The standard tool for installing Python packages is pip . It has a feature that allows you to specify all the packages you...
Read more >pip install — pip 10.0.0.dev0 documentation
Note that if a satisfactory version of the package is already installed, the VCS source will not overwrite it without an –upgrade flag....
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Same here. In my case, there is a line in the requirements.txt that starts with
#
, quite suspicious.Edit: might be intentional. See https://github.com/pypa/pipenv/blob/9f41427a678e816538cec891f2e655e05a7eaad3/HISTORY.txt#L5
Btw, if there was an option for having
pipenv install
installing to a specific folder I would not be usingpipenv lock -r
.