Speed up update-python3-dependencies

The `make update-python3-dependencies` step is slow for two main
reasons: container image layering and pip-compile.

Currently, each `pip-compile` step is run in a separate dev-shell, which
means after each one, if anything changed in the requirements/ folder,
it needs to rebuild the slim image and reinstall all the pip
dependencies.

Now I've moved the steps to a separate script that execute in a single
dev-shell, so no image rebuilding happens during the updates, it'll just
be needed once afterwards.

For an additional boost, switch to the new uv tool, which reimplements
pip-compile in a much faster way. The output is basically the same,
except the sorting is smarter (e.g. pytest comes before pytest-cov) and
package names are properly normalized. We can also drop the
`--allow-unsafe` because uv is entirely independent of setuptools and
pip-tools.

uv is still quite new to the Python ecosystem, but this allows us to
begin using it without any lock-in, it should be trivial to swap back to
pip-tools if needed.

Overall `make update-python3-dependencies` now takes seconds to run
instead of minutes \o/

Refs <freedomofpress/securedrop-tooling#16>.

Makefile

@@ -29,27 +29,7 @@ update-admin-pip-requirements:  ## Update admin requirements.
 .PHONY: update-python3-requirements
 update-python3-requirements:  ## Update Python 3 requirements with pip-compile.
 	@echo "███ Updating Python 3 requirements files..."
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/develop-requirements.txt \
-		requirements/python3/translation-requirements.in \
-		requirements/python3/develop-requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/test-requirements.txt \
-		requirements/python3/test-requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-				--allow-unsafe \
-		--output-file requirements/python3/requirements.txt \
-		requirements/python3/requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/bootstrap-requirements.txt \
-		requirements/python3/bootstrap-requirements.in
-	@SLIM_BUILD=1 $(DEVSHELL) pip-compile --generate-hashes \
-		--allow-unsafe \
-		--output-file requirements/python3/translation-requirements.txt \
-		requirements/python3/translation-requirements.in
+	@SLIM_BUILD=1 $(DEVSHELL) $(SDBIN)/update-requirements
 
 .PHONY: update-pip-requirements
 update-pip-requirements: update-admin-pip-requirements update-python3-requirements ## Update all requirements with pip-compile.

securedrop/bin/update-requirements

@@ -0,0 +1,19 @@
+#!/bin/bash
+set -euxo pipefail
+
+uv pip compile --generate-hashes \
+    --output-file requirements/python3/develop-requirements.txt \
+    requirements/python3/translation-requirements.in \
+    requirements/python3/develop-requirements.in
+uv pip compile --generate-hashes \
+    --output-file requirements/python3/test-requirements.txt \
+    requirements/python3/test-requirements.in
+uv pip compile --generate-hashes \
+    --output-file requirements/python3/requirements.txt \
+    requirements/python3/requirements.in
+uv pip compile --generate-hashes \
+    --output-file requirements/python3/bootstrap-requirements.txt \
+    requirements/python3/bootstrap-requirements.in
+uv pip compile --generate-hashes \
+    --output-file requirements/python3/translation-requirements.txt \
+    requirements/python3/translation-requirements.in

securedrop/requirements/python3/bootstrap-requirements.txt

@@ -1,13 +1,19 @@
-#
-# This file is autogenerated by pip-compile
-# To update, run:
-#
-#    pip-compile --allow-unsafe --generate-hashes --output-file=requirements/python3/bootstrap-requirements.txt requirements/python3/bootstrap-requirements.in
-#
+# This file was autogenerated by uv via the following command:
+#    uv pip compile --generate-hashes --output-file requirements/python3/bootstrap-requirements.txt requirements/python3/bootstrap-requirements.in
 packaging==24.1 \
     --hash=sha256:026ed72c8ed3fcce5bf8950572258698927fd1dbda10a5e981cdf0ac37f4f002 \
     --hash=sha256:5b8f2217dbdbd2f7f384c41c628544e6d52f2d0f53c6d0c3ea61aa5d1d7ff124
     # via setuptools-scm
+pip==21.3 \
+    --hash=sha256:4a1de8f97884ecfc10b48fe61c234f7e7dcf4490a37217011ad9369d899ad5a6 \
+    --hash=sha256:741a61baab1dbce2d8ca415effa48a2b6a964564f81a9f4f1fce4c433346c034
+    # via -r requirements/python3/bootstrap-requirements.in
+setuptools==70.3.0 \
+    --hash=sha256:f171bab1dfbc86b132997f26a119f6056a57950d058587841a0082e8830f9dc5 \
+    --hash=sha256:fe384da74336c398e0d956d1cae0669bc02eed936cdb1d49b57de1990dc11ffc
+    # via
+    #   -r requirements/python3/bootstrap-requirements.in
+    #   setuptools-scm
 setuptools-scm==8.1.0 \
     --hash=sha256:42dea1b65771cba93b7a515d65a65d8246e560768a66b9106a592c8e7f26c8a7 \
     --hash=sha256:897a3226a6fd4a6eb2f068745e49733261a21f70b1bb28fce0339feb978d9af3
@@ -24,15 +30,3 @@ wheel==0.38.4 \
     --hash=sha256:965f5259b566725405b05e7cf774052044b1ed30119b5d586b2703aafe8719ac \
     --hash=sha256:b60533f3f5d530e971d6737ca6d58681ee434818fab630c83a734bb10c083ce8
     # via -r requirements/python3/bootstrap-requirements.in
-
-# The following packages are considered to be unsafe in a requirements file:
-pip==21.3 \
-    --hash=sha256:4a1de8f97884ecfc10b48fe61c234f7e7dcf4490a37217011ad9369d899ad5a6 \
-    --hash=sha256:741a61baab1dbce2d8ca415effa48a2b6a964564f81a9f4f1fce4c433346c034
-    # via -r requirements/python3/bootstrap-requirements.in
-setuptools==70.3.0 \
-    --hash=sha256:f171bab1dfbc86b132997f26a119f6056a57950d058587841a0082e8830f9dc5 \
-    --hash=sha256:fe384da74336c398e0d956d1cae0669bc02eed936cdb1d49b57de1990dc11ffc
-    # via
-    #   -r requirements/python3/bootstrap-requirements.in
-    #   setuptools-scm

securedrop/requirements/python3/develop-requirements.in

@@ -19,9 +19,7 @@ molecule-vagrant==0.3
 # Needed for ansible network filter
 # http://docs.ansible.com/ansible/latest/playbooks_filters_ipaddr.html
 netaddr
-# Now also pin pip due to https://github.com/jazzband/pip-tools/issues/853
-pip>=21.3
-pip-tools>=6.1.0
+pip
 polib
 prompt_toolkit==2.0.9
 psutil>=5.6.6
@@ -44,4 +42,5 @@ six==1.15.0
 testinfra>=5.3.1
 translate-toolkit
 urllib3>=1.26.5
+uv
 yamllint