python -m pip install --require-hashes --no-deps -r requirements.txt

.github/workflows/docs.yaml

@@ -40,16 +40,16 @@ jobs:
       - name: Install Protoc
         uses: arduino/setup-protoc@v1
         with:
-          version: '3.x'
+          version: "3.x"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
         run: |
           set -x
           python3 -m venv venv
           source venv/bin/activate
-          pip install -r requirements.txt
-          pip install -r docs/requirements.txt
+          pip install --require-hashes --no-deps -r requirements.txt
+          pip install --require-hashes --no-deps -r docs/requirements.txt
       - name: Build Datafusion
         run: |
           set -x

.github/workflows/test.yaml

@@ -87,15 +87,15 @@ jobs:
           python -m venv venv
           source venv/bin/activate
           pip install -U pip
-          pip install -r requirements.txt
+          pip install --require-hashes --no-deps -r requirements.txt
 
       - name: Create Virtualenv (3.7)
         if: ${{ matrix.python-version == '3.7' }}
         run: |
           python -m venv venv
           source venv/bin/activate
           pip install -U pip
-          pip install -r requirements-37.txt
+          pip install --require-hashes --no-deps -r requirements-37.txt
 
       - name: Run Python Linters
         if: ${{ matrix.python-version == '3.11' && matrix.toolchain == 'stable' }}

README.md

@@ -202,7 +202,7 @@ source venv/bin/activate
 # update pip itself if necessary
 python -m pip install -U pip
 # install dependencies (for Python 3.8+)
-python -m pip install -r requirements.txt
+python -m pip install --require-hashes --no-deps -r requirements.txt
 ```
 
 The tests rely on test data in git submodules.

dev/release/verify-release-candidate.sh

@@ -128,7 +128,7 @@ test_source_distribution() {
   python3 -m venv venv
   source venv/bin/activate
   python3 -m pip install -U pip
-  python3 -m pip install -r requirements.txt
+  python3 -m pip install --require-hashes --no-deps -r requirements.txt
   maturin develop
 
   #TODO: we should really run tests here as well

docs/source/index.rst

@@ -241,7 +241,7 @@ Bootstrap:
     # update pip itself if necessary
     python -m pip install -U pip
     # install dependencies (for Python 3.8+)
-    python -m pip install -r requirements.txt
+    python -m pip install --require-hashes --no-deps -r requirements.txt
 
 The tests rely on test data in git submodules.