note: these sdists are now reproducibly built. Ideally the person updating the pinned hash should be different from the one who uploaded the dep to PyPI and reproduce and verify the hash. This prevents hiding a backdoor in just the sdist uploaded to PyPI. but people can try to reproduce the PyPI sdists at any time and ring alarm bells if they can't
Notes
The frozen dependency lists in this folder are generated files.
- Starting from
contrib/requirements/requirements*.txt, - we use the
contrib/freeze_packages.shscript, - to generate
contrib/deterministic-build/requirements*.txt.
The source files list direct dependencies with loose version requirements, while the output files list all transitive dependencies with exact version+hash pins.
The build scripts only use these hash pinned requirement files.