pip requirements.txt file - what's the right style?

[John]

Hello, 

With respect to the requirements.txt file associated with pip, there seems to be two philosophies. While it always specifies a baseline for any given module, general it allows greater releases. In the discern module, exact modules are required. What's the right style? For a development machine, I like baseline and greater. Is specifying the exact version import for deployment? 

-jk

        (edx)jkern@ubuntu:~/workspace/python/edX/discern$ git diff base-requirements.txt 

        diff --git a/base-requirements.txt b/base-requirements.txt

        index 760ced9..6258d54 100644

        --- a/base-requirements.txt

        +++ b/base-requirements.txt

        @@ -1,4 +1,4 @@

        -Django==1.5

        +Django>=1.5

         mimeparse==0.1.3

         lxml==3.0.1

         pyyaml==3.10

        @@ -10,7 +10,7 @@ celery-with-redis==3.0

         gunicorn==0.17.2

         requests==1.1.0

         dogstatsd-python==0.2

        -boto==2.6.0

        +boto>=2.6.0

         django-pipeline==1.3.6

         django-guardian==1.1.0.beta

         django-request-provider==1.0.2

        @@ -21,4 +21,4 @@ django-nose==1.1

         path.py==3.1

         django-allauth==0.10.1

         python-memcached==1.48

        -django-ses==0.4.1

        \ No newline at end of file

        +django-ses==0.4.1

[James Tauber]

My personal recommendation is to always pin to specific releases.

Tools like yolk make it fairly easy to see what needs to be upgraded and that's far less painful than dealing with things breaking due to unintended upgrades (especially on deploy)

James

[John]

Hello James,

For this approach(i.e., pin specific modules) to work, all edX projects would have to agree on the exact baseline. At the moment, they do not. 

discern/ease requires 2.6.0 while configure requires 2.8.0.

XBlock requires 'Django >= 1.4, < 1.5' but discern/ease requires Django==1.5.

During the development phrase, individual projects will need a new version or to avoid a buggy one. Making them out of sync with the other projects. How can we keep all projects in Sync? How would someone propose upgrading a module others depend on too? 

-John

[James Tauber]

discern and ease don't run in the same virtualenv as the main edx platform so this specific example isn't a problem and as we move more and more to an SOA, this will extend to other components.

But that said, we are actually in the process of better tracking dependencies and specific versions so it's easier to keep in sync.

James