build: no longer use hashed pins #1592

Author: nedbat

.github/workflows/coverage.yml

@@ -85,7 +85,7 @@ jobs:
           set -xe
           python -VV
           python -m site
-          python -m pip install --require-hashes -r requirements/tox.pip
+          python -m pip install -r requirements/tox.pip
 
       - name: "Run tox coverage for ${{ matrix.python-version }}"
         env:

.github/workflows/kit.yml

@@ -155,7 +155,7 @@ jobs:
 
       - name: "Install tools"
         run: |
-          python -m pip install --require-hashes -r requirements/kit.pip
+          python -m pip install -r requirements/kit.pip
 
       - name: "Build wheels"
         env:
@@ -192,7 +192,7 @@ jobs:
 
       - name: "Install tools"
         run: |
-          python -m pip install --require-hashes -r requirements/kit.pip
+          python -m pip install -r requirements/kit.pip
 
       - name: "Build sdist"
         run: |

.github/workflows/python-nightly.yml

@@ -81,7 +81,7 @@ jobs:
 
       - name: "Install dependencies"
         run: |
-          python -m pip install --require-hashes -r requirements/tox.pip
+          python -m pip install -r requirements/tox.pip
 
       - name: "Run tox"
         run: |

.github/workflows/quality.yml

@@ -46,7 +46,7 @@ jobs:
 
       - name: "Install dependencies"
         run: |
-          python -m pip install --require-hashes -r requirements/tox.pip
+          python -m pip install -r requirements/tox.pip
 
       - name: "Tox lint"
         run: |
@@ -97,7 +97,7 @@ jobs:
           set -xe
           python -VV
           python -m site
-          python -m pip install --require-hashes -r requirements/tox.pip
+          python -m pip install -r requirements/tox.pip
 
       - name: "Tox doc"
         run: |

.github/workflows/testsuite.yml

@@ -73,7 +73,7 @@ jobs:
           set -xe
           python -VV
           python -m site
-          python -m pip install --require-hashes -r requirements/tox.pip
+          python -m pip install -r requirements/tox.pip
           # For extreme debugging:
           # python -c "import urllib.request as r; exec(r.urlopen('https://bit.ly/pydoctor').read())"
 

CHANGES.rst

@@ -25,8 +25,11 @@ Unreleased
   dramatically smaller. This closes `issue 1584`_ thanks to `Oleh Krehel
   <pull 1587_>`_.
 
+- Development dependencies no longer use hashed pins, closing `issue 1592`_.
+
 .. _issue 1584: https://github.com/nedbat/coveragepy/issues/1584
 .. _pull 1587: https://github.com/nedbat/coveragepy/pull/1587
+.. _issue 1592: https://github.com/nedbat/coveragepy/issues/1592
 
 
 .. scriv-start-here

Makefile

@@ -85,7 +85,7 @@ metasmoke:
 
 .PHONY: upgrade
 
-PIP_COMPILE = pip-compile --upgrade --allow-unsafe --generate-hashes --resolver=backtracking
+PIP_COMPILE = pip-compile --upgrade --allow-unsafe --resolver=backtracking
 upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
 upgrade: 				## Update the *.pip files with the latest packages satisfying *.in files.
 	pip install -q -r requirements/pip-tools.pip