Use hashes for pip

Dockerfile

@@ -5,9 +5,10 @@ RUN yum -y install python python-pip python-devel git gcc libjpeg-turbo-devel \
                    libxml2-devel libxslt-devel mysql-devel mysql npm
 RUN yum -y clean all
 RUN npm install -g bower
+RUN pip install --upgrade pip
 
 COPY ./requirements/ /tmp/requirements/
-RUN pip install -r /tmp/requirements/docker.txt
+RUN pip install --no-cache-dir --require-hashes --no-deps -r /tmp/requirements/docker.txt
 
 WORKDIR /app
 COPY . /app

requirements/base.txt

@@ -1,36 +1,96 @@
 # Basic
-django==1.10.5
-django-shortuuidfield==0.1.3
+django==1.10.5 \
+    --hash=sha256:4541a60834f28f308ee7b6e96400feca905fb0de473eb9dad6847e98a36d86d4
+django-shortuuidfield==0.1.3 \
+    --hash=sha256:a292c0fe5538abe947b131e2b914edd9ac44afcc6a40eaec71448e6231a3ef00
 
 # Configuration
-unicode-slugify==0.1.3
-django-autoslug==1.9.3
-django_dotenv==1.4.1
-dj-database-url==0.4.2
-opbeat==3.5.2
+unicode-slugify==0.1.3 \
+    --hash=sha256:34cf3afefa6480efe705a4fc0eaeeaf7f49754aec322ba3e8b2f27dc1cbcf650
+django-autoslug==1.9.3 \
+    --hash=sha256:d466a68e87d076f0d0d6ffe51ff70fa22ae4ca2f7717d769feb6265ef68c50f8
+django_dotenv==1.4.1 \
+    --hash=sha256:2930f6b0c0955ac150e1ca9ac01e84afa71efdbb544dea7155f026e20e401305
+dj-database-url==0.4.2 \
+    --hash=sha256:e16d94c382ea0564c48038fa7fe8d9c890ef1ab1a8ec4cb48e732c124b9482fd
+opbeat==3.5.2 \
+    --hash=sha256:085f42cd2efd8fb4a394ab635fd35d0c270897b6a7303f5d347d7442f0d2bfbd
+
 
 # Cache
-redis==2.10.5
-django-redis-cache==1.7.1
+redis==2.10.5 \
+    --hash=sha256:97156b37d7cda4e7d8658be1148c983984e1a975090ba458cc7e244025191dbd
+django-redis-cache==1.7.1 \
+    --hash=sha256:2b4e3510bbcaf3d331975717afd6f15a36fbaf7622504599d2727dc99f90c64d
 
 # Security
-django-braces==1.11.0
-django-csp==3.2
+django-braces==1.11.0 \
+    --hash=sha256:6be8277a535565e2140f7b1eb83ec26aa8d181acc8bb046875142a2792e4babe
+django-csp==3.2 \
+    --hash=sha256:7cec78ba7c426deba6d4bea188dcfc1a8b2609ad98dd539c365605c9ec2996b2
 
 # Images
-Pillow==4.0.0
-django_compressor==2.1.1
-django-bower==5.2.0
+Pillow==4.0.0 \
+    --hash=sha256:a57f32a2f09ed61800e687aec0b2eebb095499116f50eff99e27e03ed9a8d776
+django_compressor==2.1.1 \
+    --hash=sha256:6483f6091d614b2f3ddaa0d5061849e7bd40528f4f1fdf0d74e48df09e7c6699
+django-bower==5.2.0 \
+    --hash=sha256:f1cf649842c0cb28f8aa28617e99fc7fb7773bac4e8886ee4e36962a38c99a6e
 
 # Users
-django-allauth==0.30.0
-django-avatar==3.1.0
-django-crispy-forms==1.6.1
+django-allauth==0.30.0 \
+    --hash=sha256:231f1e980dee8ee56be4f64e6a4b77cb32b41d977e6ea6bd310b2c8c0bc354bb
+django-avatar==3.1.0 \
+    --hash=sha256:0e29c99e488061f9ef9cc1fb52306e31d849379fb63aa5acd2adeb400a106e84
+django-crispy-forms==1.6.1 \
+    --hash=sha256:18e904c7bd55c45201739cb343272767ff820263a1fca40a7b388006ce94910c
 
 # Astronomy
-git+https://github.com/comzeradd/orbit.git@cache##egg=orbit
+https://github.com/comzeradd/orbit/archive/0.2.1.tar.gz \
+    --hash=sha256:cb7c9d54c5bfba435d7b7cfa0563be64c859ae9169f1388eb5e2124774cf9a62
 
 # API
-djangorestframework==3.5.4
-Markdown==2.6.8
-django-filter==1.0.1
+djangorestframework==3.5.4 \
+    --hash=sha256:110afa12784ceadfb50808882689302d266785b51e3d13286744333ff6d78e60
+Markdown==2.6.8 \
+    --hash=sha256:0ac8a81e658167da95d063a9279c9c1b2699f37c7c4153256a458b3a43860e33
+django-filter==1.0.1 \
+    --hash=sha256:7cca9dab22c72df734ba24fb81ca018fdb6d2020c840e758d473dcedd341aa7b
+
+# Deps
+shortuuid==0.5.0 \
+    --hash=sha256:d08fd398f40f8baf87e15eef8355e92fa541bca4eb8465fefab7ee22f92711b9
+six==1.10.0 \
+    --hash=sha256:0ff78c403d9bccf5a425a6d31a12aa6b47f1c21ca4dc2573a7e2f32a97335eb1
+Unidecode==0.04.20 \
+    --hash=sha256:eedac7bfd886f43484787206f6a141b232e2b2a58652c54d06499b187fd84660
+urllib3==1.20 \
+    --hash=sha256:b64c0faa183e9e9e76193146c4147e82a734982c6b6719dca851d6cc4ec90c01
+certifi==2017.1.23 \
+    --hash=sha256:f74a224a9860fd5a2e9757230a7ea3eba82d6d46914780abc18e70c8b58d4bf8
+olefile==0.44 \
+    --hash=sha256:61f2ca0cd0aa77279eb943c07f607438edf374096b66332fae1ee64a6f0f73ad
+django-appconf==1.0.2 \
+    --hash=sha256:ddab987d14b26731352c01ee69c090a4ebfc9141ed223bef039d79587f22acd9
+rcssmin==1.0.6 \
+    --hash=sha256:ca87b695d3d7864157773a61263e5abb96006e9ff0e021eff90cbe0e1ba18270
+rjsmin==1.0.12 \
+    --hash=sha256:dd9591aa73500b08b7db24367f8d32c6470021f39d5ab4e50c7c02e4401386f1
+rcssmin==1.0.6 \
+    --hash=sha256:ca87b695d3d7864157773a61263e5abb96006e9ff0e021eff90cbe0e1ba18270
+requests==2.13.0 \
+    --hash=sha256:1a720e8862a41aa22e339373b526f508ef0c8988baf48b84d3fc891a8e237efb
+requests_cache==0.4.13 \
+    --hash=sha256:e9270030becc739b0a7f7f834234c73a878b2d794122bf76f40055a22419eb67
+requests-oauthlib==0.8.0 \
+    --hash=sha256:50a8ae2ce8273e384895972b56193c7409601a66d4975774c60c2aed869639ca
+oauthlib==2.0.1 \
+    --hash=sha256:132ad46df25e53a84b33f1fd43f80e973cda2cb018cc0168d7d0c8c4d5cef9b5
+python-openid==2.2.5 \
+    --hash=sha256:92c51c3ecec846cbec4aeff11f9ff47303d4a63f93b0e6ac0ec02a091fed70ef
+lxml==3.7.3 \
+    --hash=sha256:9fd1aef1e6d834e5191383bd1db7a0b56a564905ab9060e30ee6964aabbb905a
+pyephem==3.7.6.0 \
+    --hash=sha256:143146da32a07a4cf9725b5656ba095d24978c22a0363414203e72c39bae52bd
+olefile==0.44 \
+    --hash=sha256:61f2ca0cd0aa77279eb943c07f607438edf374096b66332fae1ee64a6f0f73ad

requirements/dev.txt

@@ -2,15 +2,67 @@
 -r base.txt
 
 # Debug & Testing
-sqlparse==0.2.2
-flake8==3.3.0
-factory-boy==2.8.1
-pytest==3.0.6
-pytest-cov==2.4.0
-pytest-django==3.1.2
+sqlparse==0.2.2 \
+    --hash=sha256:9b61c319b3c7b64681e1b4d554a9c3fe81ed52da00a901ccf3fe72962734e444
+flake8==3.3.0 \
+    --hash=sha256:83905eadba99f73fbfe966598aaf1682b3eb6755d2263c5b33a4e8367d60b0d1
+factory-boy==2.8.1 \
+    --hash=sha256:246f7da9caf9bf855aaa73b4963353ccb147fdd3adcbc419fa29422c5b69dd4c
+pytest==3.0.6 \
+    --hash=sha256:da0ab50c7eec0683bc24f1c1137db1f4111752054ecdad63125e7ec71316b813
+pytest-cov==2.4.0 \
+    --hash=sha256:10e37e876f49ddec80d6c83a54b657157f1387ebc0f7755285f8c156130014a1
+pytest-django==3.1.2 \
+    --hash=sha256:00995c2999b884a38ae9cd30a8c00ed32b3d38c1041250ea84caf18085589662
+pytest-xdist==1.15.0 \
+    --hash=sha256:6238395f8bd050f9288a3b10f34330edece80f4424cf2b4204d6e7d622f0f00b
+python-coveralls==2.9.0 \
+    --hash=sha256:1f22b69e166ec27475954b65033e21ba54c6a68779c2d39762ce5c4dcbe013d3
+coverage==4.3.4 \
+    --hash=sha256:ca36d83cd591d027952e5019149c4386e7058cd674bf8cb52dc622f768d689e9
+faker==0.7.7 \
+    --hash=sha256:249d1bd8fddb80643d4dc91b72c6089c847ab2d0deead946a6d339209ac24146
+docopts==0.6.1 \
+    --hash=sha256:ea8d6b03a0931c75a0e4919a0b0856f1c187c38a96174a750c86b41b903a693a
+mock==2.0.0 \
+    --hash=sha256:5ce3c71c5545b472da17b72268978914d0252980348636840bd34a00b5cc96c1
+
+# Deps
+configparser==3.5.0 \
+    --hash=sha256:5308b47021bc2340965c371f0f058cc6971a04502638d4244225c49d80db273a
+pycodestyle==2.3.1 \
+    --hash=sha256:6c4245ade1edfad79c3446fadfc96b0de2759662dc29d07d80a6f27ad1ca6ba9
+pyflakes==1.5.0 \
+    --hash=sha256:cc5eadfb38041f8366128786b4ca12700ed05bbf1403d808e89d57d67a3875a7
+mccabe==0.6.1 \
+    --hash=sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42
+enum34==1.1.6 \
+    --hash=sha256:6bd0f6ad48ec2aa117d3d141940d484deccda84d4fcd884f5c3d93c23ecd8c79
+ipaddress==1.0.18 \
+    --hash=sha256:d34cf15d95ce9a734560f7400a8bd2ac2606f378e2a1d0eadbf1c98707e7c74a
+python_dateutil==2.6.0 \
+    --hash=sha256:537bf2a8f8ce6f6862ad705cd68f9e405c0b5db014aa40fa29eab4335d4b1716
+appdirs==1.4.0 \
+    --hash=sha256:85e58578db8f29538f3109c11250c2a5514a2fcdc9890d9b2fe777eb55517736
+packaging==16.8 \
+    --hash=sha256:99276dc6e3a7851f32027a68f1095cd3f77c148091b092ea867a351811cfe388
+py==1.4.32 \
+    --hash=sha256:2d4bba2e25fff58140e6bdce1e485e89bb59776adbe01d490baa6b1f37a3dd6b
+pyparsing==2.1.10 \
+    --hash=sha256:67101d7acee692962f33dd30b5dce079ff532dd9aa99ff48d52a3dad51d2fe84
+setuptools==34.2.0 \
+    --hash=sha256:75d352eeeddd96a3fb702b1da9f8b89e5f8c045dbd86e3894516733eb5f99713
+apipkg==1.4 \
+    --hash=sha256:65d2aa68b28e7d31233bb2ba8eb31cda40e4671f8ac2d6b241e358c9652a74b9
+execnet==1.4.1 \
+    --hash=sha256:d2b909c7945832e1c19cfacd96e78da68bdadc656440cfc7dfe59b766744eb8c
 pytest-xdist==1.15.0
-python-coveralls==2.9.0
-coverage==4.3.4
-faker
-docopts
-mock==2.0.0
+    --hash=sha256:6238395f8bd050f9288a3b10f34330edece80f4424cf2b4204d6e7d622f0f00b
+docopt==0.6.1 \
+    --hash=sha256:71ad940a773fbc23be6093e9476ad57b2ecec446946a28d30127501f3b29aa35
+funcsigs==1.0.2 \
+    --hash=sha256:330cc27ccbf7f1e992e69fef78261dc7c6569012cf397db8d3de0234e6c937ca
+pbr==1.10.0 \
+    --hash=sha256:f5cf7265a80636ecff66806d13494cbf9d77a3758a65fd8b4d4d4bee81b0c375
+PyYAML==3.12 \
+    --hash=sha256:592766c6303207a20efc445587778322d7f73b161bd994f227adaa341ba212ab

requirements/docker.txt

@@ -1,4 +1,5 @@
 # Docker-only dependencies
 -r dev.txt
 
-MySQL-python==1.2.5
+MySQL-python==1.2.5 \
+    --hash=sha256:811040b647e5d5686f84db415efd697e6250008b112b6909ba77ac059e140c74

requirements/production.txt

@@ -1,5 +1,7 @@
 # Production-only dependencies
 -r base.txt
 
-MySQL-python==1.2.5
-gunicorn==19.6.0
+MySQL-python==1.2.5 \
+    --hash=sha256:811040b647e5d5686f84db415efd697e6250008b112b6909ba77ac059e140c74
+gunicorn==19.6.0 \
+    --hash=sha256:723234ea1fa8dff370ab69830ba8bc37469a7cba13fd66055faeef24085e6530