Which is really a required dependency anyway?

[2bndy5]

we should be using a better way to ensure our direct dependencies and their sub-dependencies are cohesive. We can consider this pipenv library as an alternative/option to solve this issue

[2bndy5]

I'm re-posting this from a Slack chat after slimming down the requirements.txt to only include libraries we are actually importing in our code with a special exception to eventlet per flask docs about production servers which are required for using websockets.

Most of the following links lead to the line in the repository's setup.py file that indicates what sub-dependencies they are installing during installation of our direct dependencies. Non-library related links lead to additional information.

• git+<our-undeployed-repo-url>.git commands require git installed & added to the system's "PATH" environment variable (a commonly default condition on Linux, but not on Windows). Prefixing these items with -e makes importing modules from multi-module packages (like our Drivetrain library) much easier using eggs, but pip has trouble looking for the eggs during install. Most of our custom repository installs require:
  1. adafruit-blinka (see link below)
  2. adafruit-circuitpython-busdevice (for I2C & SPI devices)
  3. Our GPS_Serial requires pyserial (no python sub-dependencies, but can rely on cp2110 and CH340 USB serial drivers)

• Flask

• Adafruit-Blinka

• Jinja2

• Flask-SocketIO

• python-socketio

• eventlet

• opencv-python

• pyxtermjs

Fortunately, we are no longer using GPIOzero

As of this writing our requirements file now looks like this:

git+https://github.com/2bndy5/Adafruit_CircuitPython_LSM9DS1.git
git+https://github.com/2bndy5/CircuitPython_MPU6050.git
git+https://github.com/DVC-Viking-Robotics/Drivetrain.git
git+https://github.com/DVC-Viking-Robotics/GPS_Serial.git
circuitpython-nrf24l01==1.1.0
opencv-python==3.4.3.18
pyserial==3.4
Flask==1.0.2
Flask-CacheBuster==1.0.0
Flask-Compress==1.4.0
Flask-Login==0.4.1
Flask-SocketIO==3.3.2
eventlet==0.24.1
pyxtermjs==0.4.0.1

As a reminder, you can use pip list to have pip spit out a list of all packages installed in your current environments site-packages folder and elsewhere if you added to python's "PATH" environment variable.

[tejashah88]

After doing some investigating with the Pipenv project, here's what I found:

• Pipenv uses the concept of lock files, which are comprehensive documents that specify exactly what dependency versions and sub-dependency versions should be installed, right down to the sha256 values. This also has the added benefit of security, should the network be compromised.
• The requirements.txt would be replaced by the new Pipfile, which not only specifies the dependency versions but allows you to specify developer dependencies and the python version needed for the project. This is similar to how npm works, with their corresponding package.json and package-lock.json.
• Upon running pipenv install, it will automatically create a virtual environment that sits outside of the project folder (for the case of Ubuntu: ~/.local/share/virtualenvs/) as well as install the dependencies from the Pipfile and Pipfile.lock files.
• The installations via pipenv are designed to be deterministic (meaning we always get the same version for every single library), which is exactly what we want to solve this problem. This also means that the way of installing dependencies will be different from the native python way.