# in-toto runtime requirements plus securesystemslib with extra dependencies
#
# This file together with 'pip-compile' is used to generate a pinned
# requirements file with all immediate and transitive dependencies.
#
# 'requirements-pinned.txt' is updated on GitHub with Dependabot, which
# triggers CI/CD builds to automatically test against updated dependencies.
#
#
# NOTE: 'pip-compile' only adds dependencies relevant for the Python version,
# in which it is executed. Moreover, it does not add environment markers of
# transitive dependencies.
# The official recommendation for cross-environment usage of pip-compile tends
# towards separate requirements files for each environment (see
# jazzband/pip-tools#651), this seem like an overkill for in-toto, where we
# only have a few conditional dependencies, i.e. dependencies that are required
# on Python < 3 only.
#
#
# Below instructions can be used to re-generate 'requirements-pinned.txt', e.g.
# if:
# - requirements are added or removed from this file
# - Python version support is changed
# - CI/CD build breaks due to updates (e.g. transitive dependency conflicts)
# - it also makes sense to run this every now and then to see if the update
#   of an immediate dependency requires the addition or removal of a transitive
#   dependency).
#
# FIXME: We should fully automate this, otherwise requirements-pinned.txt is
# prone to become outdated.
#
#
# 1. Use this script to create a pinned requirements file for each Python
#    version
# ```
# for v in 2.7 3.6 3.7 3.8 3.9; do
#   mkvirtualenv in-toto-env-${v} -p python${v};
#   pip install pip-tools;
#   pip-compile --no-header -o requirements-${v}.txt requirements.txt;
#   deactivate;
#   rmvirtualenv in-toto-env-${v};
# done;
#
# ```
# 2. Use this command to merge per-version files
#    `sort -o requirements-pinned.txt -u requirements-?.?.txt`
# 2. Manually add environment markers to requirements-pinned.txt
# 3. Use this command to remove per-version files
#    `rm requirements-?.?.txt`
#
securesystemslib[crypto,pynacl]>=0.18.0
attrs
python-dateutil
iso8601
six
pathspec
