Update requirements.txt files with hashes.

Author: skoppula

Dockerfile

@@ -69,14 +69,16 @@ ENV FORCE_CUDA 1
 SHELL ["/bin/bash", "-l", "-c"]
 
 WORKDIR $HOME
-RUN pip3 install pip setuptools wheel
 
 # Copy in the code to open-source
-COPY --chown=$uid:$gid ./requirements_gpu.txt $HOME/
+COPY --chown=$uid:$gid ./requirements_all_with_hashes.txt $HOME/
+COPY --chown=$uid:$gid ./requirements_gpu_with_hashes.txt $HOME/
+COPY --chown=$uid:$gid ./requirements_cpu_with_hashes.txt $HOME/
 COPY --chown=$uid:$gid ./perceiver_helpers.py $HOME/
 COPY --chown=$uid:$gid ./perceiver_blocks.py $HOME/
 COPY --chown=$uid:$gid ./perceiver_test.py $HOME/
 COPY --chown=$uid:$gid ./perceiver.py $HOME/
 
 # install any extra Python requirements defined in requirements.txt
-RUN pip3 install -r requirements_gpu.txt
+RUN pip3 install --require-hashes -r requirements_all_with_hashes.txt
+RUN pip3 install --require-hashes -r requirements_gpu_with_hashes.txt

README.md

@@ -20,10 +20,10 @@ To create and activate a virtualenv and install all necessary dependencies, run:
 python3 -m venv /tmp/hip_venv
 source /tmp/hip_venv/bin/activate
 pip3 install pip setuptools wheel
-pip3 install -r requirements_gpu.txt
+pip3 install -r requirements_gpu_with_hashes.txt
 ```
 
-`requirements_gpu.txt` will require a working CUDA installation, and `nvidia-cuda-toolkit` installed. Otherwise, you can replace this with `requirements_cpu.txt` which does not have this dependency.
+`requirements_gpu_with_hashes.txt` will require a working CUDA installation, and `nvidia-cuda-toolkit` installed. Otherwise, you can replace this with `requirements_cpu_with_hashes.txt` which does not have this dependency.
 
 Running `python3 -m unittest -v perceiver_test` after this will run a suite of
 tests that demonstrates running the HiP architecture on sample multimodal data.

requirements_all_with_hashes.txt

@@ -0,0 +1,23 @@
+#
+# This file is autogenerated by pip-compile with Python 3.7
+# by the following command:
+#
+#    pip-compile --allow-unsafe --extra-index-url=https://storage.googleapis.com/jax-releases/jax_cuda_releases.html --generate-hashes --output-file=requirements_gpu_with_hashes1.txt requirements1.in
+#
+--extra-index-url https://storage.googleapis.com/jax-releases/jax_cuda_releases.html
+--find-links https://storage.googleapis.com/jax-releases/jax_cuda_releases.html
+
+wheel==0.40.0 \
+    --hash=sha256:cd1196f3faee2b31968d626e1731c94f99cbdb67cf5a46e4f5656cbee7738873 \
+    --hash=sha256:d236b20e7cb522daf2390fa84c55eea81c5c30190f90f29ae2ca1ad8355bf247
+    # via -r requirements1.in
+
+# The following packages are considered to be unsafe in a requirements file:
+pip==23.1.2 \
+    --hash=sha256:0e7c86f486935893c708287b30bd050a36ac827ec7fe5e43fe7cb198dd835fba \
+    --hash=sha256:3ef6ac33239e4027d9a5598a381b9d30880a1477e50039db2eac6e8a8f6d1b18
+    # via -r requirements1.in
+setuptools==67.7.2 \
+    --hash=sha256:23aaf86b85ca52ceb801d32703f12d77517b2556af839621c641fca11287952b \
+    --hash=sha256:f104fa03692a2602fa0fec6c6a9e63b6c8a968de13e17c026957dd1f53d80990
+    # via -r requirements1.in