From fcbc976091012949101e5c8bd0a1a0d2410a8c6e Mon Sep 17 00:00:00 2001
From: Jiayu Liu <jiayu@hey.com>
Date: Wed, 10 May 2023 21:39:16 +0800
Subject: [PATCH] python -m pip install --require-hashes --no-deps -r
 requirements.txt

---
 .github/workflows/docs.yaml             | 6 +++---
 .github/workflows/test.yaml             | 4 ++--
 README.md                               | 2 +-
 dev/release/verify-release-candidate.sh | 2 +-
 docs/source/index.rst                   | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index fb422cec3..264293257 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -40,7 +40,7 @@ jobs:
       - name: Install Protoc
         uses: arduino/setup-protoc@v1
         with:
-          version: '3.x'
+          version: "3.x"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
@@ -48,8 +48,8 @@ jobs:
           set -x
           python3 -m venv venv
           source venv/bin/activate
-          pip install -r requirements.txt
-          pip install -r docs/requirements.txt
+          pip install --require-hashes --no-deps -r requirements.txt
+          pip install --require-hashes --no-deps -r docs/requirements.txt
       - name: Build Datafusion
         run: |
           set -x
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 0431a83f6..a54540427 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -87,7 +87,7 @@ jobs:
           python -m venv venv
           source venv/bin/activate
           pip install -U pip
-          pip install -r requirements.txt
+          pip install --require-hashes --no-deps -r requirements.txt
 
       - name: Create Virtualenv (3.7)
         if: ${{ matrix.python-version == '3.7' }}
@@ -95,7 +95,7 @@ jobs:
           python -m venv venv
           source venv/bin/activate
           pip install -U pip
-          pip install -r requirements-37.txt
+          pip install --require-hashes --no-deps -r requirements-37.txt
 
       - name: Run Python Linters
         if: ${{ matrix.python-version == '3.11' && matrix.toolchain == 'stable' }}
diff --git a/README.md b/README.md
index cdd2c0be4..5011ad6a8 100644
--- a/README.md
+++ b/README.md
@@ -202,7 +202,7 @@ source venv/bin/activate
 # update pip itself if necessary
 python -m pip install -U pip
 # install dependencies (for Python 3.8+)
-python -m pip install -r requirements.txt
+python -m pip install --require-hashes --no-deps -r requirements.txt
 ```
 
 The tests rely on test data in git submodules.
diff --git a/dev/release/verify-release-candidate.sh b/dev/release/verify-release-candidate.sh
index a3fb36ffe..7a3f553f8 100755
--- a/dev/release/verify-release-candidate.sh
+++ b/dev/release/verify-release-candidate.sh
@@ -128,7 +128,7 @@ test_source_distribution() {
   python3 -m venv venv
   source venv/bin/activate
   python3 -m pip install -U pip
-  python3 -m pip install -r requirements.txt
+  python3 -m pip install --require-hashes --no-deps -r requirements.txt
   maturin develop
 
   #TODO: we should really run tests here as well
diff --git a/docs/source/index.rst b/docs/source/index.rst
index f8ff735eb..66ba62aac 100644
--- a/docs/source/index.rst
+++ b/docs/source/index.rst
@@ -241,7 +241,7 @@ Bootstrap:
     # update pip itself if necessary
     python -m pip install -U pip
     # install dependencies (for Python 3.8+)
-    python -m pip install -r requirements.txt
+    python -m pip install --require-hashes --no-deps -r requirements.txt
 
 The tests rely on test data in git submodules.