Fix Tor Weather pipeline (pip install overrides poetry.lock pins)
Building the Tor Weather wheel is working fine. However, we are failing in the Verify
stage. While we do pin hashes in poetry.lock
this gets bypassed by python3 -m pip install dist/tor_weather-*.whl
which grabs the latest available versions it seems potentially resulting in a version mismatch and broken Tor Weather setups. For instance, right now we pin flask
to version 2.3.3 but running python3 -m pip install dist/tor_weather-*.whl
in our pipeline actually results in
Collecting flask (from tor-weather==1.1.1)
Obtaining dependency information for flask from https://files.pythonhosted.org/packages/36/42/015c23096649b908c809c69388a805a571a3bea44362fe87e33fc3afa01f/flask-3.0.0-py3-none-any.whl.metadata
Downloading flask-3.0.0-py3-none-any.whl.metadata (3.6 kB)