Override requirements (at a given level) from a requirements file.

changes/476.feature.rst

@@ -0,0 +1 @@
+Support for pinned requirements files has been added

docs/reference/configuration.rst

@@ -302,6 +302,21 @@ application level, *and* platform level, the final set of requirements will be
 the *concatenation* of requirements from all levels, starting from least to
 most specific.
 
+``requires_lock``
+~~~~~~~~~~~~~~~~~
+
+The name of a lock file.
+If the file exists,
+its contents will be used instead of the
+value of the
+``requires``
+field.
+
+Use
+``briefcase update -r --relock``
+to recompute the lock file.
+
+
 ``revision``
 ~~~~~~~~~~~~
 
@@ -415,6 +430,21 @@ level, application level, *and* platform level, the final set of requirements
 will be the *concatenation* of requirements from all levels, starting from least
 to most specific.
 
+
+``test_requires_lock``
+~~~~~~~~~~~~~~~~~~~~~~
+
+The name of a lock file.
+If the file exists,
+its contents will be used instead of the
+value of the
+``test_requires``
+field.
+
+Use
+``briefcase update -r --test --relock``
+to update the lock file.
+
 ``test_sources``
 ~~~~~~~~~~~~~~~~
 

setup.cfg

@@ -79,6 +79,7 @@ install_requires =
     cookiecutter >= 2.1, < 3.0
     dmgbuild >= 1.6, < 2.0; sys_platform == "darwin"
     GitPython >= 3.1, < 4.0
+    pip-tools >= 6.13, < 7.0
     platformdirs >= 2.6, < 4.0
     psutil >= 5.9, < 6.0
     requests >= 2.28, < 3.0

src/briefcase/commands/base.py

@@ -673,6 +673,12 @@ def _add_update_options(
             help=f"Update requirements for the app{context_label}",
         )
 
+        parser.add_argument(
+            "--relock",
+            action="store_true",
+            help=f"Recalculate locked requirements for the app{context_label}",
+        )
+
         parser.add_argument(
             "--update-resources",
             action="store_true",

src/briefcase/commands/create.py

@@ -4,6 +4,7 @@
 import shutil
 import subprocess
 import sys
+import tempfile
 from datetime import date
 from pathlib import Path
 from typing import List, Optional
@@ -487,7 +488,48 @@ def _install_app_requirements(
         else:
             self.logger.info("No application requirements.")
 
-    def install_app_requirements(self, app: BaseConfig, test_mode: bool):
+    def _calc_app_requirements(self, app: BaseConfig, test_mode: bool, relock: bool):
+        requires = app.requires.copy() if app.requires else []
+        if test_mode and app.test_requires:
+            requires.extend(app.test_requires)
+
+        lock_attr = "requires_lock" if not test_mode else "test_requires_lock"
+        try:
+            lock_value = getattr(app, lock_attr)
+        except AttributeError:
+            return requires
+        else:
+            lock_file = self.base_path / lock_value
+
+        if relock:
+            with tempfile.NamedTemporaryFile(mode="w+") as fpout:
+                fpout.writelines(line + "\n" for line in requires)
+                fpout.flush()
+                res = self.tools[app].app_context.run(
+                    [
+                        sys.executable,
+                        "-u",
+                        "-m",
+                        "piptools",
+                        "compile",
+                        fpout.name,
+                        "--output-file=-",
+                    ],
+                    text=True,
+                    capture_output=True,
+                    check=True,
+                )
+            lock_file.write_text(res.stdout)
+
+        requires = [
+            line.split("#", 1)[0].strip() for line in lock_file.read_text().splitlines()
+        ]
+        requires = [potential for potential in requires if potential != ""]
+        return requires
+
+    def install_app_requirements(
+        self, app: BaseConfig, test_mode: bool, relock: bool = False
+    ):
         """Handle requirements for the app.
 
         This will result in either (in preferential order):
@@ -504,9 +546,7 @@ def install_app_requirements(self, app: BaseConfig, test_mode: bool):
         :param app: The config object for the app
         :param test_mode: Should the test requirements be installed?
         """
-        requires = app.requires.copy() if app.requires else []
-        if test_mode and app.test_requires:
-            requires.extend(app.test_requires)
+        requires = self._calc_app_requirements(app, test_mode, relock)
 
         try:
             requirements_path = self.app_requirements_path(app)
@@ -766,7 +806,7 @@ def create_app(self, app: BaseConfig, test_mode: bool = False, **options):
         self.install_app_code(app=app, test_mode=test_mode)
 
         self.logger.info("Installing requirements...", prefix=app.app_name)
-        self.install_app_requirements(app=app, test_mode=test_mode)
+        self.install_app_requirements(app=app, test_mode=test_mode, relock=True)
 
         self.logger.info("Installing application resources...", prefix=app.app_name)
         self.install_app_resources(app=app)

src/briefcase/commands/update.py

@@ -23,6 +23,7 @@ def update_app(
         update_requirements: bool,
         update_resources: bool,
         test_mode: bool,
+        relock: bool,
         **options,
     ):
         """Update an existing application bundle.
@@ -47,7 +48,7 @@ def update_app(
 
         if update_requirements:
             self.logger.info("Updating requirements...", prefix=app.app_name)
-            self.install_app_requirements(app=app, test_mode=test_mode)
+            self.install_app_requirements(app=app, test_mode=test_mode, relock=relock)
 
         if update_resources:
             self.logger.info("Updating application resources...", prefix=app.app_name)

tests/commands/build/test_call.py

@@ -3,6 +3,14 @@
 from briefcase.exceptions import BriefcaseCommandError
 
 
+def _clean_relock(actions):
+    for cmd, *rest in actions:
+        if cmd not in {"run", "build", "create", "update"}:
+            continue
+        rest[-1].pop("relock", None)
+    return actions
+
+
 def test_specific_app(build_command, first_app, second_app):
     """If a specific app is requested, build it."""
     # Add two apps
@@ -18,7 +26,7 @@ def test_specific_app(build_command, first_app, second_app):
     build_command(first_app, **options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -47,7 +55,7 @@ def test_multiple_apps(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -81,7 +89,7 @@ def test_non_existent(build_command, first_app_config, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -121,7 +129,7 @@ def test_unbuilt(build_command, first_app_unbuilt, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -155,7 +163,7 @@ def test_update_app(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -213,7 +221,7 @@ def test_update_app_requirements(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -271,7 +279,7 @@ def test_update_app_resources(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -329,7 +337,7 @@ def test_update_non_existent(build_command, first_app_config, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -384,7 +392,7 @@ def test_update_unbuilt(build_command, first_app_unbuilt, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -442,7 +450,7 @@ def test_build_test(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -501,7 +509,7 @@ def test_build_test_no_update(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -540,7 +548,7 @@ def test_build_test_update_dependencies(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -599,7 +607,7 @@ def test_build_test_update_resources(build_command, first_app, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -716,7 +724,7 @@ def test_test_app_non_existent(build_command, first_app_config, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified
@@ -772,7 +780,7 @@ def test_test_app_unbuilt(build_command, first_app_unbuilt, second_app):
     build_command(**options)
 
     # The right sequence of things will be done
-    assert build_command.actions == [
+    assert _clean_relock(build_command.actions) == [
         # Host OS is verified
         ("verify-host",),
         # Tools are verified

tests/commands/create/conftest.py

@@ -118,7 +118,7 @@ def generate_app_template(self, app):
     def install_app_support_package(self, app):
         self.actions.append(("support", app.app_name))
 
-    def install_app_requirements(self, app, test_mode):
+    def install_app_requirements(self, app, test_mode, relock=False):
         self.actions.append(("requirements", app.app_name, test_mode))
 
     def install_app_code(self, app, test_mode):