Confirmed users
1,158
edits
WebDev/Deployments: Difference between revisions
Jump to navigation
Jump to search
no edit summary
(Created page with "This covers deploying of production systems using pip and PyPI. This currently an option for add-ons and the marketplace. For the rest of WebDev a server similar to [https://ma...") |
No edit summary |
||
| Line 15: | Line 15: | ||
All requirements should be pinned, eg: | All requirements should be pinned, eg: | ||
foo==0.3 | foo==0.3 | ||
Use of >= or not pinning to a version is not recommended. This can | Use of <code>>=</code> or not pinning to a version is not recommended. This can mean untrusted versions of packages being installed. | ||
When run use --no-deps. This ensures that packages will not pull in more | When run use <code>--no-deps</code>. This ensures that packages will not pull in more untrusted versions of packages. It also means that the requirements files are a definitive source of packages used. This allows security faster audits of who is using what package. | ||
==Internal package server== | ==Internal package server== | ||
| Line 33: | Line 33: | ||
Contributors and external users will continue to use PyPI as normal. Internal production deployments will use this mirror by using the --no-index and --find-links. For example in Marketplace: | Contributors and external users will continue to use PyPI as normal. Internal production deployments will use this mirror by using the --no-index and --find-links. For example in Marketplace: | ||
./venv/bin/pip install --exists-action=w --no-deps --no-index -f http://pyrepo1.addons.phx1.mozilla.com/ -r requirements/prod.txt | ./venv/bin/pip install --exists-action=w --no-deps --no-index | ||
-f http://pyrepo1.addons.phx1.mozilla.com/ -r requirements/prod.txt | |||
==Future goals== | ==Future goals== | ||
If we can build RPMs prior to deploying, this will allow security to more easily audit the source of files. Currently services and socorro do this. | If we can build RPMs prior to deploying, this will allow security to more easily audit the source of files. Currently services and socorro do this. | ||