# Hash-pinned build tools for the Flatpak dependency generator.
#
# WHY THIS FILE EXISTS
# --------------------
# The `generate` job in .github/workflows/flatpak.yml used to run
#
#     python3 -m pip install --quiet --upgrade uv req2flatpak
#
# and then used those two tools to write `packaging/flatpak/python3-yazses.json`
# -- the list of 45 wheels, each with a URL and a hash, that Flathub builds the
# app from.
#
# That is the pin problem inverted. The whole value of the generated file is that
# it pins; the program that decides what those pins ARE was installed from
# whatever PyPI served that minute, with `--upgrade` to make sure it was the very
# newest. A compromised `req2flatpak` writes attacker URLs and matching hashes
# into a file a human then reviews as "45 pinned wheels" -- and hashes are
# precisely what a reviewer does not re-derive by hand.
#
# So the generator's own inputs are hash-pinned here, and installed with
# `--require-hashes`, which makes pip refuse anything whose artifact does not
# match. The closure is four packages, so this costs almost nothing to carry.
#
# `packaging==21.3` is old, and it is not a mistake: req2flatpak 0.3.1 declares
# `packaging<22.0,>=21.3`, and `pyparsing` is here only because packaging 21.x
# still needed it. Nothing from this file is shipped -- these run on a CI runner
# to produce a JSON file and are then discarded.
#
# TO REGENERATE (after changing the two tool names above, or to take newer
# versions deliberately):
#
#     printf 'uv\nreq2flatpak\n' > /tmp/tools.in
#     uv pip compile --generate-hashes --python-version 3.12 \
#       --python-platform x86_64-manylinux2014 \
#       /tmp/tools.in -o packaging/flatpak/tools-requirements.txt
#
# then restore this comment block, which `uv pip compile` does not preserve.
packaging==21.3 \
    --hash=sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb \
    --hash=sha256:ef103e05f519cdc783ae24ea4e2e0f508a9c99b2d4969652eed6a2e1ea5bd522
    # via req2flatpak
pyparsing==3.3.2 \
    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
    # via packaging
req2flatpak==0.3.1 \
    --hash=sha256:1fc26c00d38d2b1c49115a764ab7decd69971fa7820548a0a232581643376a3c \
    --hash=sha256:528bd91151222ae9be3d293002fb04d7885db4628bdedc592473da1f364423e2
    # via the tool list above
uv==0.12.18 \
    --hash=sha256:03da66a73d0ac01fb7a95d096aebf5993b51ec65df620d57f415e111e6789c88 \
    --hash=sha256:0a3c4e415515bd4c24c7516523d9042a2957ce716423e193f8b2be9fb8773340 \
    --hash=sha256:0a8fa0c6408c1bedf8a19219b471d6c14ae98695940b20269fcb7514a136cfa4 \
    --hash=sha256:145f17e2b7f165da9bd4dd14c4c2525d5b1647cb8daadb684106babedbc502ff \
    --hash=sha256:328abf19b5992b4846f96d1d4440cdd9e0b7d20c0f00b0644e68ca8cfb561c26 \
    --hash=sha256:4f9769cf34558a026ff9b8e04cdf9d25c16fe3d61f35956daf6548f2b0379ff0 \
    --hash=sha256:53a035e48cbe94ca47ee304b293060b690d0ac03140a64ff3ff4713eabcede99 \
    --hash=sha256:77b71bc25d274a04594d32167b0f766fb5b6805980c3aed02872c468e1905e7e \
    --hash=sha256:799dcef1ef97ab6491b34f5827e2da8dd9153d65be056c779b60a2d4d3d6c45b \
    --hash=sha256:98a8a4786db518b4d708eacc96aadfc0626072d5873c708bcab8239e6453176d \
    --hash=sha256:99c64f9f3eea3eb3fd496c29da47462824da0e47775b3b39d444d9832c815549 \
    --hash=sha256:9aa0ef69c7cb2aff485a0e9ce46feeb7b6dbeef3d796ffd04b944cf355ba8334 \
    --hash=sha256:9c237410b6b193e691c7c37752fd7f3cfebd9b5d5331c53e748f004c6397334f \
    --hash=sha256:9c77a4de02c2b7737f6d4eb5fcd359bc0f0948f2a4133f8095c527addb84fc56 \
    --hash=sha256:b656468f973ac363ac96b0b6b9bf9c5f5836cd84b664d0ca67b67bb8e35f9bcf \
    --hash=sha256:cbbfcca37cf678b5135f61f722631a2a85e2eddc459ba64692054011f160f6c2 \
    --hash=sha256:d5037ec17654c756fc9841270f413c5fc9ecef89108b443f5dd34600a3ccdb19 \
    --hash=sha256:e7ab1387b222ab640dbd057b95548a199e4c621aa35e9f6a32c0516c76e7637d \
    --hash=sha256:fbe0489871e74ebfb70379a32526c62b9fb615acf13576b9f19bc09a142f62b0
    # via the tool list above
