Merge pull request #1011 from kdmukai/pin_l10n_requirements

[security] Hash-lock the l10n requirements pins

.github/workflows/tests.yml

@@ -53,7 +53,13 @@ jobs:
         run: |
           sudo apt-get install libzbar0
           python -m pip install --upgrade pip
-          pip install -r requirements.txt -r tests/requirements.txt -r l10n/requirements-l10n.txt
+          pip install -r requirements.txt -r tests/requirements.txt
+          # requirements-l10n.txt is hash-locked (SeedSigner OS installs it
+          # during image builds). It needs its own pip invocation: one hashed
+          # requirement makes pip demand hashes for everything else in the
+          # same invocation, which the unhashed files above and `-e .` below
+          # can't satisfy.
+          pip install -r l10n/requirements-l10n.txt
           pip install -e .
       - name: Compile translations
         run: python setup.py compile_catalog

l10n/requirements-l10n.txt

@@ -1,2 +1,19 @@
-Babel==2.16.0
+# Dependencies for the translation workflow (setup.py extract_messages /
-setuptools>=82.0.0
+# compile_catalog). Also installed during SeedSigner OS image builds to
+# compile the .mo catalogs, so entries are pinned and hash-locked: pip
+# refuses any artifact that does not match a hash below. Hashes cover every
+# published file of each release (wheel + sdist).
+#
+# To update a pin: change the version, then refresh its hashes from
+# https://pypi.org/pypi/<package>/<version>/json (or pip download + pip hash).
+#
+# NOTE: install this file in its own `pip install` invocation. Combining it
+# with unhashed requirements files (or `-e .`) in one invocation fails,
+# because any hash in an invocation makes pip require hashes for everything
+# in it.
+Babel==2.16.0 \
+    --hash=sha256:368b5b98b37c06b7daf6696391c3240c938b37767d4584413e8438c5c435fa8b \
+    --hash=sha256:d1f3554ca26605fe173f3de0c65f750f5a42f924499bf134de6423582298e316
+setuptools==84.0.0 \
+    --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
+    --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73