Elgato_dark/python-tuf
1
0
Fork 0
mirror of https://github.com/theupdateframework/python-tuf synced 2026-05-24 10:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

build: constrain version in verify_release script

Browse source 
In #2528 we added a workaround in cd.yml, which allows pinning the
build backend version AND having Dependabot autodupates for it.

This workaround also needs to be applied verify_release for reproducible
builds verification.

Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
This commit is contained in:
Lukas Puehringer 2024-01-11 16:13:13 +01:00
parent e3dc0953ee
commit 73cf25efe8
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
verify_release
View file

@ -45,8 +45,14 @@ def build(build_dir: str) -> str:
git_cmd = ["git", "clone", "--quiet", orig_dir, src_dir]
subprocess.run(git_cmd, stdout=subprocess.DEVNULL, check=True)
# patch env to constrain build backend version as we do in cd.yml
env = os.environ.copy()
env["PIP_CONSTRAINT"] = "requirements/build.txt"
build_cmd = ["python3", "-m", "build", "--outdir", build_dir, src_dir]
subprocess.run(build_cmd, stdout=subprocess.DEVNULL, check=True)
subprocess.run(
build_cmd, stdout=subprocess.DEVNULL, check=True, env=env
)
build_version = None
for filename in os.listdir(build_dir):