Problem: We need to refine pip-compile expectations when building applications

[ross-spencer]

Please describe the problem you'd like to be solved.

We recently introduced a mechanism to pin requirements in Archivematica and the Storage Service: See the Makefile here

There are two discussion points:

• pip-compile seems to be unpredictable, see the removal of appnope
• It also seems to output into the requirements, packages listed as unsafe

Describe the solution you'd like to see implemented.

As a team, and for the future of CR, e.g. for external contributions, we just need to understand our expectations, and how we need to refine how we pin requirements that is consistent and that we're happy with, and so we might use settings that exist --allow-unsafe (discussed in Slack) to specify we'll only allow this type of output on test.txt or local.txt but not production.txt. There may be other strategies.

While we are still early on in the conversation we might also decide on alternatives, PyUp used in Scope for example.

Additional context

The use of pip-compile is new in Archivematica 1.10.

Related issues

Related permissions issue running make with docker-compose.

---

For Artefactual use:
Please make sure these steps are taken before moving this issue from Review to Verified in Waffle:

• All PRs related to this issue are properly linked 👍
• All PRs related to this issue have been merged 👍
• Test plan for this issue has been implemented and passed 👍
• Documentation regarding this issue has been written and it has been added to the release notes, if needed 👍

[cole]

The adding/removal of appnope seems to be a platform specific issue. Ipython requires appnope on OS X (source link), so one way to solve that would be for Mac users to run make via docker.