Pin Python package versions using constraint files

[TimoWilken]

Constraint files are supported in pip 7.1+. The oldest we have pre-installed (on slc7 and slc8) is pip 9.0.3, so this is supported everywhere.

[TimoWilken]

Hi @ktf @adriansev, what do you think about this?

It seems that with the previous approach of installing Python packages with a plain -r requirements.txt, the versions specified in that file aren't necessarily always installed (e.g. we specify Cython==0.x, but things still broke when the latest version became 3.x).

With constaint files, pip should always install the exact version that we specify, and not let anything else override it, even if something else would otherwise pull in a different version.

[adriansev]

well, i have no reason to be against it! I can only express my view on xrootd and xjalienfs components that i think should be ok:

• xrootd in principles should have no problems.. but there is a commit like:
  xrootd/xrootd@5fbcf7a
  which is only in master for the moment, so if we want to upgrade we need to wait for the next release
• xjalienfs it is still compatible with python 3.6 (and it's dependencies will be installed with the highest compatible version)

So, famous last words, we should not have problems :)

[TimoWilken]

You're right @adriansev, xjalienfs and other packages that install Python packages on top of Python-modules might end up causing version updates, since they won't use the constraint file. This wouldn't completely prevent newer package versions from being installed accidentally then...

[adriansev]

@TimoWilken if there is a need for it, i can add my requirements to Python-modules and constrain them there .. but note the the whole dependency chain would also need to be constrained and we need to establish if this does not make some packages incompatible with other ..

[TimoWilken]

Yeah, it's probably a bigger job. It might be better to install the constraint files in the Python-modules-list package, so that other Python-based packages can use them when they install their own stuff.