Adds pip-compile to build-requirements

The initial installation of pip-tools we can compare hashes with what's
on PyPI. Thereafter, installation will be trusting the pinned reqs file
during initial bootstrapping, and the custom-built wheel going forward.

.circleci/config.yml

@@ -244,7 +244,6 @@ jobs:
             virtualenv -p python3 .venv
             source .venv/bin/activate
             pip install -r test-requirements.txt
-            pip install --require-hashes --no-index --no-deps --no-cache-dir -r build-requirements.txt --find-links ./bootstrap/
             sudo sed -i -re "292s/^(\s+).*\$/\1return _.prepend_to_build_command_raw('')/" /usr/lib/python3/dist-packages/reprotest/build.py
             pytest -vvs tests/test_reproducible_wheels.py
 

requirements.in

@@ -15,3 +15,6 @@ cython==0.29.22
 
 # For pep517
 flit_core >=2,<3
+
+# For maintaining requirements files
+pip-tools>=6

requirements.txt

@@ -8,6 +8,10 @@ build==0.3.0 \
     --hash=sha256:0eb95b2c8d770d7c4c9b92c68c227c350bbf65f3ec83551ace9097c18cc15fdd \
     --hash=sha256:75bc5676b1a014fb996dc96914428b197d174364392a46778200d5e115ffe76c
     # via -r requirements.in
+click==7.1.2 \
+    --hash=sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a \
+    --hash=sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc
+    # via pip-tools
 cython==0.29.22 \
     --hash=sha256:105d813eedf276588a02a240ece2f7bca8235aee9bb48e25293410c3c1ac7230 \
     --hash=sha256:15b2ba47858d7949a036d4ba6e838120bf3c06983769e99d12867a2c8cd0cd91 \
@@ -58,7 +62,13 @@ packaging==20.9 \
 pep517==0.9.1 \
     --hash=sha256:3985b91ebf576883efe5fa501f42a16de2607684f3797ddba7202b71b7d0da51 \
     --hash=sha256:aeb78601f2d1aa461960b43add204cc7955667687fbcf9cdb5170f00556f117f
-    # via build
+    # via
+    #   build
+    #   pip-tools
+pip-tools==6.0.1 \
+    --hash=sha256:3b0c7b95e8d3dfb011bb42cb38f356fcf5d0630480462b59c4d0a112b8d90281 \
+    --hash=sha256:50ec26df7710557ab574f19f7511830294999e6121b42b87473b48cb9984d788
+    # via -r requirements.in
 pyparsing==2.4.7 \
     --hash=sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1 \
     --hash=sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b
@@ -101,7 +111,9 @@ zipp==3.4.1 \
 pip==21.0.1 \
     --hash=sha256:37fd50e056e2aed635dec96594606f0286640489b0db0ce7607f7e51890372d5 \
     --hash=sha256:99bbde183ec5ec037318e774b0d8ae0a64352fe53b2c7fd630be1d07e94f41e5
-    # via -r requirements.in
+    # via
+    #   -r requirements.in
+    #   pip-tools
 setuptools==54.0.0 \
     --hash=sha256:34efee89c4c879204f5739ec6d9d3635195b0b7d2b51e25c9261a327367ec5ff \
     --hash=sha256:d85b57c41e88b69ab87065c964134ec85b7573cbab0fdaa7ef32330ed764600a

scripts/install-deps

@@ -35,3 +35,15 @@ if [[ "$wheel_mime_types" != "application/zip" ]]; then
     git checkout bootstrap/ localwheels/
     git lfs fetch
 fi
+
+# Support existing activated virtualenv, e.g. via virtualenvwrapper.
+if [[ -z "$VIRTUAL_ENV" ]]; then
+    echo "Creating local virtualenv..."
+    python3 -m venv .venv
+    . .venv/bin/activate
+else
+    echo "Virtualenv already activated, skipping creation..."
+fi
+
+# Install the 'build' tool from previously prepared localwheels
+pip install --require-hashes --no-index --no-deps --no-cache-dir -r build-requirements.txt --find-links ./bootstrap/