Revert "remove require-hashes for now"

This reverts commit 7a7e12130a.

.devcontainer/postCreateCommand.sh

@@ -27,7 +27,7 @@ python3 -m pip install --upgrade pip
 pip3 install --ignore-installed --upgrade invoke Pillow
 
 # install base level packages
-pip3 install -Ur contrib/container/requirements.txt
+pip3 install -Ur contrib/container/requirements.txt --require-hashes
 
 # Run initial InvenTree server setup
 invoke update -s

.github/actions/setup/action.yaml

@@ -95,7 +95,7 @@ runs:
       - name: Install dev requirements
         if: ${{ inputs.dev-install == 'true' || inputs.install == 'true' }}
         shell: bash
-        run: uv pip install  -r src/backend/requirements-dev.txt
+        run: uv pip install --require-hashes -r src/backend/requirements-dev.txt
       - name: Run invoke install
         if: ${{ inputs.install == 'true' }}
         shell: bash

.github/workflows/docker.yaml

@@ -162,7 +162,7 @@ jobs:
           python-version: ${{ env.python_version }}
       - name: Version Check
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
           echo "git_commit_hash=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
           echo "git_commit_date=$(git show -s --format=%ci)" >> $GITHUB_ENV

.github/workflows/qc_checks.yaml

@@ -99,7 +99,7 @@ jobs:
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # pin@v3.0.1
       - name: Check Version
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
 
   typecheck:
@@ -140,8 +140,8 @@ jobs:
           python-version: ${{ env.python_version }}
       - name: Check Config
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
-          pip install  -r docs/requirements.txt
+          pip install --require-hashes -r docs/requirements.txt
           python docs/ci/check_mkdocs_config.py
       - name: Check Links
         uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # pin@v1
@@ -189,7 +189,7 @@ jobs:
         env:
           API: ${{ needs.paths-filter.outputs.api }}
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
           version="$(python3 .github/scripts/version_check.py --show-api-version --decrement-api=${API} 2>&1)"
           echo "API Version: $version"
           url="https://raw.githubusercontent.com/inventree/schema/main/export/${version}/api.yaml"
@@ -223,7 +223,7 @@ jobs:
         id: version
         if: github.ref == 'refs/heads/master' && needs.paths-filter.outputs.api == 'true'
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
           version="$(python3 .github/scripts/version_check.py --show-api-version 2>&1)"
           echo "API Version: $version"
           echo "version=$version" >> "$GITHUB_OUTPUT"

.github/workflows/release.yaml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
       - name: Version Check
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
       - name: Push to Stable Branch
         uses: ad-m/github-push-action@77c5b412c50b723d2a4fbc6d71fb5723bcd439aa # pin@v1.0.0
@@ -119,8 +119,8 @@ jobs:
           npm: true
       - name: Install dependencies
         run: |
-          pip install  -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
-          pip install  -r docs/requirements.txt
+          pip install --require-hashes -r docs/requirements.txt
       - name: Build documentation
         run: |
           invoke build-docs --mkdocs

contrib/container/Dockerfile

@@ -111,8 +111,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # Build and install python dependencies
-RUN pip install --user  -r base_requirements.txt --no-cache-dir && \
+RUN pip install --user --require-hashes -r base_requirements.txt --no-cache-dir && \
-    pip install --user  -r requirements.txt --no-cache-dir && \
+    pip install --user --require-hashes -r requirements.txt --no-cache-dir && \
     pip cache purge && \
     rm -rf /root/.cache/pip
 

contrib/packager.io/functions.sh

@@ -146,7 +146,7 @@ function detect_envs() {
 
     # Install parser
     echo "# POI03| Installing requirements"
-    pip install  -r ${APP_HOME}/contrib/dev_reqs/requirements.txt -q
+    pip install --require-hashes -r ${APP_HOME}/contrib/dev_reqs/requirements.txt -q
     echo "# POI03| Installed requirements"
 
     # Load config

tasks.py

@@ -432,7 +432,7 @@ def run_install(c, uv, install_file, run_preflight=True):
             )
         run(
             c,
-            f'pip3 install --no-cache-dir --disable-pip-version-check -U  -r {install_file}',
+            f'pip3 install --no-cache-dir --disable-pip-version-check -U --require-hashes -r {install_file}',
         )
     else:
         if run_preflight:
@@ -440,7 +440,7 @@ def run_install(c, uv, install_file, run_preflight=True):
                 c,
                 'pip3 install --no-cache-dir --disable-pip-version-check -U uv setuptools',
             )
-        run(c, f'uv pip install -U   -r {install_file}')
+        run(c, f'uv pip install -U --require-hashes -r {install_file}')
 
 
 def yarn(c, cmd):
@@ -568,7 +568,7 @@ def setup_dev(c, tests=False):
     info("Installing required python packages from 'src/backend/requirements-dev.txt'")
 
     # Install required Python packages with PIP
-    run(c, 'pip3 install -U  -r src/backend/requirements-dev.txt')
+    run(c, 'pip3 install -U --require-hashes -r src/backend/requirements-dev.txt')
 
     # Install pre-commit hook
     info('Installing pre-commit for checks before git commits...')