cireqs
======
Tool to expand and pin requirements files and verify that they are
complete.
Installation
------------
Install from `pypi <https://pypi.python.org/pypi/cireqs>`__.
``pip install cireqs``
Cireqs needs a working install of docker locally.
Usage
-----
Use cireqs to expand and pin down your dependencies.
You can then check in the resulting requirements file and stop worrying
about floating versions.
.. code:: bash
cireqs --dirpath /tmp expand input_requirements_filename output_requirements_filename
Use cireqs to verify that a requirements file is pinned down and
includes all requirements of requirements.
.. code:: bash
cireqs verify input_requirements
Defaults
^^^^^^^^
Cireqs uses overridable defaults:
- **dirpath:** set to current working directory (``PWD``)
- **pythonversion:** set to ``3.6.1``
- **output\_requirements\_filename:** set to ``requirements.txt``
- **input\_requirements\_filename:** set to:
-
- ``requirements.txt`` in *verify*
-
- ``requirements_to_expand.txt`` in *expand*
private packages
----------------
To install private packages like with Gemfury you have to inject your
private access token as an env var to cireqs, use the **--envar**
(``-e``) option to pass in env-vars to the pip install process. you can
specify them in the following ways:
::
cireqs --envar foo=bar
Will set the envvar foo to the value bar
::
cireqs --envvar foo
will set the envvar foo to the value of the hosts ``foo`` env var.
Gemfury example
~~~~~~~~~~~~~~~
create a requirements\_to\_expand.txt file with the following contents:
::
--index-url https://${GEM_FURY_TOKEN}@pypi.fury.io/trustpilot/
--extra-index-url https://pypi.org/simple/
secret_private_package
to expand run
::
cireqs --envvar GEM_FURY_TOKEN expand
And cireqs will inject the hosts value of ``GEM_FURY_TOKEN`` into the
``expand`` process.
Continuous Integration
----------------------
Use it in your **CI** of choice!!!
**travis**
.. code:: yaml
services:
- docker
before_script:
- pip install cireqs
script:
- cireqs verify
CLI
---
Cireqs includes the ``cireqs`` command:
::
Usage: cireqs [OPTIONS] COMMAND [ARGS]...
Options:
--pythonversion TEXT python version to use for calculating dependencies,
defaults to 3.6.1
--dirpath TEXT path to directory containing requirement files,
defaults to PWD
--timeout INTEGER how long to wait for docker commands, defaults to 120s
-e, --envvar TEXT environment var ENV_VAR=VALUE (or ENV_VAR to copy
env_var), multiple allowed, defaults to None
-V, --version show version and exit
--dry print out docker command line without running it
-v, --verbosity LVL Either CRITICAL, ERROR, WARNING, INFO or DEBUG
--help Show this message and exit.
Commands:
expand Expand given requirements file by extending...
expand_requirements
verify Verifying that given requirements file is not...
verify_requirements
.. |Build Status| image:: https://travis-ci.org/trustpilot/python-cireqs.svg?branch=master
:target: https://travis-ci.org/trustpilot/python-cireqs
.. |Latest Version| image:: https://img.shields.io/pypi/v/cireqs.svg
:target: https://pypi.python.org/pypi/cireqs
.. |Python Support| image:: https://img.shields.io/pypi/pyversions/cireqs.svg
:target: https://pypi.python.org/pypi/cireqs
History
=======
0.0.1 (2017-08-09)
------------------
* git init
0.0.2 (2017-08-09)
------------------
* missing manifest file
0.0.3 (2017-08-10)
------------------
* readme changes
* cli splash changes
* make cireqs functions pass python version to docker_execute
* pass timeout param from cli to cireqs
0.0.4 (2017-08-10)
------------------
* tox testing for py27, py33, py34, py35, py36
* more thorough diffing of requirements files
* more tests
* use prospector for linting
0.1.3 (2017-08-11)
------------------
* single source version in setup.py and cli
0.2.2 (2017-08-14)
------------------
* default timeout value for docker operations increased to 120 seconds (from 10)
1.0.0 (2017-11-01)
------------------
* introduce verify and expand and deprecate verify_requirements and expand_requirements by showing warnings
* message when commands are successful
1.0.3 (2018-03-26)
------------------
* Handle pip giving an upgrade warning
1.0.4 (2018-07-24)
------------------
* Upgrade pip before installing requirements to avoid upgrade error.
2.0.0 (2018-12-14)
------------------
* added --dry option for running dry (printing docker cmd line)
* added -V for printing version
* added --envvar (-e) for injecting env vars into the docker container running pip install, useful for private repos like in Gemfury.io
2.0.1 (2018-12-14)
------------------
* warns and exits on missing input_requirements file
2.0.2 (2018-12-14)
------------------
* warns and exits on package requiring different pythonversion than specified
2.0.3 (2018-12-17)
------------------
* avoid using alpine linux as bse image since its compiled without gcc (makes it impossible to install UVLOOP for instance)
Metadata
Release files for cireqs 2.0.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| cireqs-2.0.3.tar.gz | 8.6 kB | Without provenance | Details for cireqs-2.0.3.tar.gz |
Release files / cireqs-2.0.3.tar.gz
| Download URL | cireqs-2.0.3.tar.gz |
|---|---|
| Size | 8.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
4916fba5ae791198a15c603814cb9fd668fab7c2bf01ea043ae7365538ff1c72
|
|
BLAKE2b-256 checksum How to use checksums |
33a43974d2da21083d1e7d67ffdb01155db47759848d7829d4e8be5f7e4f33ee
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.12.1 pkginfo/1.4.2 requests/2.21.0 setuptools/40.6.3 requests-toolbelt/0.8.0 tqdm/4.28.1 CPython/3.5.6
|
Security for cireqs 2.0.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.