mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-29 00:42:08 +00:00
thePR0M3TH3ANandClaude Opus 5
c4c1e1dff9
The Windows job could never install from this lockfile and the Linux/macOS jobs could never verify it, for the same underlying reason: pip-compile resolves version-conditional dependencies for the interpreter it runs on and emits no markers, so 3.10 and 3.11 produce genuinely different files — 135 lines apart, argon2-cffi-bindings among them. Which direction matters. A 3.10 resolution is a superset: it carries async-timeout, which aiohttp requires below 3.11, and installs cleanly under --require-hashes on 3.11. A 3.11 resolution is missing it, so on 3.10 pip tries to fetch async-timeout unpinned and --require-hashes refuses — which is exactly how the Windows job died. So the lockfile is now compiled on 3.10, the minimum in pyproject's `python = ">=3.10,<3.13"`, and verified to install on both 3.10 and 3.11. Verification moves out of the build matrix into its own job pinned to that same interpreter. Regenerate-and-diff answers "did this file really come from src/requirements.txt", which is one question about one artifact and wants asking once, on the interpreter that produced it — not once per matrix entry on whichever Python that entry happens to use. Every platform still installs with --require-hashes, which is the part that had to stay everywhere. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN