Pin dependency versions for reproducible binaries

[scrapinghub]

Pin dependency versions for reproducible binaries

[dangra]

I don't think so, we have a chance to "pin" versions to build reproducible binaries. shub is an app, not a library, using specific versions offers a controlled environment for the tool.

[jdemaeyer]

I don't have a strong opinion, but pinning versions for the binary is gonna come at the cost of maintaining a separate requirements file.

[dangra]

The approach is better explained by http://nvie.com/posts/pin-your-packages/
and extended with http://nvie.com/posts/better-package-management/

The concrete proposal is to:

• Pin all deps (and sub deps) in requirements.txt - no additional requirements file.
• List minimum versions in setup.py (not specific versions) for pypi friendly

[jdemaeyer]

Ah okay, that looks cool. +1 as long as we don't pin in setup.py