blob: 26afe32c32d31a77fe4a8e5a5d29e377a9c26a97 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
#!/bin/bash
set -eu -o pipefail
die() {
echo "$@" >&2
exit 1
}
[[ $# == 1 && -f $1 ]] || die "Usage: $0 requirements.txt"
venv=$(mktemp -d)
depfile=$(mktemp)
trap 'rm -rf $venv $depfile' EXIT
virtualenv2 "$venv"
# shellcheck disable=SC1090
source "$venv/bin/activate"
# Use `pip download' to find the download URLs and checksums of all transitive dependencies
grep -v '^-e' "$1" | \
pip download -v -d downloads -r /dev/stdin | \
grep Added | \
grep -iv setuptools | \
sed -E 's/.*Added .* from (.*)#sha256=([0-9a-f]+) .*/\1 \2/' > "$depfile"
deactivate
shopt -s lastpipe
cut -d' ' -f1 "$depfile" | readarray -t urls
cut -d' ' -f2 "$depfile" | readarray -t hashes
# Add the URLs to source=
echo 'source+=('
printf '\t%q\n' "${urls[@]}"
echo ')'
# Add the filenames to noextract=
echo 'noextract+=('
printf '\t%q\n' "${urls[@]##*/}"
echo ')'
# Add a sha1sums SKIP for each source
echo 'sha1sums+=('
printf '\t%q\n' "${hashes[@]/*/SKIP}"
echo ')'
# Verify sha256sums
echo 'sha256sums+=('
printf '\t%q\n' "${hashes[@]}"
echo ')'
|