# Hash-pinned build tools for the Flatpak dependency generator.
#
# WHY THIS FILE EXISTS
# --------------------
# The `generate` job in .github/workflows/flatpak.yml used to run
#
#     python3 -m pip install --quiet --upgrade uv req2flatpak
#
# and then used those two tools to write `packaging/flatpak/python3-yazses.json`
# -- the list of 45 wheels, each with a URL and a hash, that Flathub builds the
# app from.
#
# That is the pin problem inverted. The whole value of the generated file is that
# it pins; the program that decides what those pins ARE was installed from
# whatever PyPI served that minute, with `--upgrade` to make sure it was the very
# newest. A compromised `req2flatpak` writes attacker URLs and matching hashes
# into a file a human then reviews as "45 pinned wheels" -- and hashes are
# precisely what a reviewer does not re-derive by hand.
#
# So the generator's own inputs are hash-pinned here, and installed with
# `--require-hashes`, which makes pip refuse anything whose artifact does not
# match. The closure is four packages, so this costs almost nothing to carry.
#
# `packaging==21.3` is old, and it is not a mistake: req2flatpak 0.3.1 declares
# `packaging<22.0,>=21.3`, and `pyparsing` is here only because packaging 21.x
# still needed it. Nothing from this file is shipped -- these run on a CI runner
# to produce a JSON file and are then discarded.
#
# TO REGENERATE (after changing the two tool names above, or to take newer
# versions deliberately):
#
#     printf 'uv\nreq2flatpak\n' > /tmp/tools.in
#     uv pip compile --generate-hashes --python-version 3.12 \
#       --python-platform x86_64-manylinux2014 \
#       /tmp/tools.in -o packaging/flatpak/tools-requirements.txt
#
# then restore this comment block, which `uv pip compile` does not preserve.
#
# To move ONE tool (e.g. a security fix) without re-resolving the others, add
# `--upgrade-package <tool>`: the existing pins in the -o file are kept as
# preferences. Dependabot does not read this file, so nothing else will bump it.
# uv went 0.12.18 -> 0.13.4 this way for PYSEC-2026-4321 (#116).
packaging==21.3 \
    --hash=sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb \
    --hash=sha256:ef103e05f519cdc783ae24ea4e2e0f508a9c99b2d4969652eed6a2e1ea5bd522
    # via req2flatpak
pyparsing==3.3.2 \
    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
    # via packaging
req2flatpak==0.3.1 \
    --hash=sha256:1fc26c00d38d2b1c49115a764ab7decd69971fa7820548a0a232581643376a3c \
    --hash=sha256:528bd91151222ae9be3d293002fb04d7885db4628bdedc592473da1f364423e2
    # via the tool list above
uv==0.13.4 \
    --hash=sha256:05e4332791b4d55b6dde8695b7fa6079b26991519f44760887c5dfbd5ca4fe53 \
    --hash=sha256:205a4f93e568fb24f45a2f3834f1c0a8f1adb5f396bf473c71030ed707dce048 \
    --hash=sha256:25cc14ff4fd8335d3be2cc493a621a003fdafcb0fb1c953c905daabe4def5ab8 \
    --hash=sha256:3a9dcb6762c3ba249d8c084315ba03839082af3ece3536cc4164ec735c351d68 \
    --hash=sha256:4e6b08578c920b86910897f36bb6da7229c8e7e0187976570e2a538cb28b777e \
    --hash=sha256:52b5c753a7c2d5f8323a70bb4c93118988356331d0758afa6446c81f974e7196 \
    --hash=sha256:5d89d1028c2e22977d9215cbb79cfe12559cb0c8a507a12e2f3a7e47930cf1bf \
    --hash=sha256:77062b02856c74697f48328d8a6583ab07e6da0a993e86c2db46f3d1da27c637 \
    --hash=sha256:7b3cdf868e5415631fe797b648c0d6945d38d388f23367bdd0b6332e80a1fcb0 \
    --hash=sha256:8ae6ff2b07892379dc767c9064c2b8bbfac88e767edac7ce28e1b0f15d86abb4 \
    --hash=sha256:95f4eb2b991b53b50ec2b18ab612fca8ba1e7a75a47af0331fb8bcd21da3eb03 \
    --hash=sha256:b0bff5b9a5061f7a35b1d0c1a94c19af134222c48eb7aadc42f85a038be1b248 \
    --hash=sha256:b2ff80397273fff0e02c20eacae6882834c811827d6fc08f658db156fe754386 \
    --hash=sha256:b4bbacea78c9db136cd2ec3147cbfd9ed910b4db5e1877109bd74d0e73bb2eaf \
    --hash=sha256:d333f01852b817ba05612de31474739da1af7e5463d119b30a9c4331eba1f408 \
    --hash=sha256:d86a5dec8ab30c70519c71ca5085c8aaf28664836cbc600951cedaa3fc678cbf \
    --hash=sha256:deffa5a4afdb48f3e44fb26e80377d256b330ddcad0373daff4b54f6162b43a4 \
    --hash=sha256:e90ab42825587821096cb0d071e387468da38cfa22818c91f9c0b3c0453048e8 \
    --hash=sha256:fb0e2028d9a8929884344afb7d91d0f65d9783f640d28aede89fca3602bedde9
    # via the tool list above
