[AURORA-618] Pin cryptographic checksums of python requirements

• Type: Story
• Status: Resolved
• Priority: Major
• Resolution: Later
• Component/s: Build, Client, Executor, Security
• Labels: newbie
• Assignee: Unassigned
• Reporter: Kevin Sweeney
• Created: 29/Jul/14 19:03
• Updated: 29/Dec/15 21:18
• Resolved: 29/Dec/15 21:18

Description

Using peep we can verify that the python packages our users build are the same as the python our committers build.

If this issue is fixed in pants we can use these checksums automatically in our build.

Issue Links

• depends upon: AURORA-617 Switch pants 3rdparty to use python_requirements
• relates to: AURORA-616 Consider using gradle-witness to verify dependencies