Pin dependency versions when using tools/venv.sh (#4629)

* Revert "Pin python-augeas version to avoid error with 1.0.0 (#4422)"

This reverts commit 1c51ae25887f2dc3168a38d1f0042363cd7ac1e3.

* make dependency-requirements

* separate certbot and dependency requirements

* fix build.py

* update hashin comment

* simplify release pinning

* separate letsencrypt dependency

* pin hashes in venv

* error out when bad things happen

* use pinned dependencies in tox

* Revert "pin hashes in venv"

This reverts commit 1cd38a9e50da94e6959728bf57aaf642807bc9c7.

* use pip_install.sh in venv_common

* quote pip install args

* bump mock version

3 files changed, 16 insertions, 8 deletions

diff --git a/tools/_venv_common.sh b/tools/_venv_common.sh
index ddbb02c62..20ed4c034 100755
--- a/tools/_venv_common.sh
+++ b/tools/_venv_common.sh
@@ -19,7 +19,7 @@ virtualenv --no-site-packages --setuptools $VENV_NAME $VENV_ARGS
 # invocations use latest
 pip install -U pip
 pip install -U setuptools
-pip install "$@"
+./tools/pip_install.sh "$@"
 
 set +x
 echo "Please run the following command to activate developer environment:"
diff --git a/tools/pip_install.sh b/tools/pip_install.sh
new file mode 100755
index 000000000..8a58f9e48
--- /dev/null
+++ b/tools/pip_install.sh
@@ -0,0 +1,13 @@
+#!/bin/sh -e
+# pip installs packages using Certbot's requirements file as constraints
+
+# get the root of the Certbot repo
+repo_root=$(git rev-parse --show-toplevel)
+requirements="$repo_root/letsencrypt-auto-source/pieces/dependency-requirements.txt"
+constraints=$(mktemp)
+trap "rm -f $constraints" EXIT
+# extract pinned requirements without hashes
+sed -n -e 's/^\([^[:space:]]*==[^[:space:]]*\).*$/\1/p' $requirements > $constraints
+
+# install the requested packages using the pinned requirements as constraints
+pip install --constraint $constraints "$@"
diff --git a/tools/release.sh b/tools/release.sh
index 1da11fe2c..3b1d4d8a6 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -170,19 +170,14 @@ cd ~-
 for pkg in acme certbot certbot-apache certbot-nginx ; do
     echo $pkg==$version \\
     pip hash dist."$version/$pkg"/*.{whl,gz} | grep "^--hash" | python2 -c 'from sys import stdin; input = stdin.read(); print "   ", input.replace("\n--hash", " \\\n    --hash"),'
-done > /tmp/hashes.$$
+done > letsencrypt-auto-source/pieces/certbot-requirements.txt
 deactivate
 
-if ! wc -l /tmp/hashes.$$ | grep -qE "^\s*12 " ; then
+if ! wc -l letsencrypt-auto-source/pieces/certbot-requirements.txt | grep -qE "^\s*12 " ; then
     echo Unexpected pip hash output
     exit 1
 fi
 
-# perform hideous surgery on requirements.txt...
-head -n -12 letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt > /tmp/req.$$
-cat /tmp/hashes.$$ >> /tmp/req.$$
-cp /tmp/req.$$ letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt
-
 # ensure we have the latest built version of leauto
 letsencrypt-auto-source/build.py