Specify deps in pyproject.toml

- Nuke python_dependencies and setup.py
- Allow commiting poetry.lock
- Initial lockfile pulling in the latest version of deps at the time of locking

Use newest signedjson

This includes a community PR which only requires importlib_metadata when
it's needed (on Python 3.7). This might alleviate some poetry pain.

.dockerignore

@@ -4,8 +4,6 @@
 # things to include
 !docker
 !synapse
-!MANIFEST.in
 !README.rst
-!setup.py
 
 **/__pycache__

.gitignore

@@ -15,6 +15,10 @@ _trial_temp*/
 .DS_Store
 __pycache__/
 
+# We do want the poetry lockfile. TODO: is there a good reason for ignoring
+# '*.lock' above? If not, let's nuke it.
+!poetry.lock
+
 # stuff that is likely to exist when you run a server locally
 /*.db
 /*.log

docker/Dockerfile

@@ -46,7 +46,7 @@ RUN \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy just what we need to pip install
-COPY MANIFEST.in README.rst setup.py /synapse/
+COPY MANIFEST.in README.rst /synapse/
 COPY synapse/__init__.py /synapse/synapse/__init__.py
 COPY synapse/python_dependencies.py /synapse/synapse/python_dependencies.py
 

mypy.ini

@@ -12,7 +12,6 @@ no_implicit_optional = True
 
 files =
   scripts-dev/,
-  setup.py,
   synapse/,
   tests/