Support vendorized dependencies

[techtonik]

To speed up deployment (#221) and secure installs, Heroku need ability to install libraries shipped with application. See
https://github.com/gratipay/inside.gratipay.com/blob/dd1491f2684bdb3c5193d5438e37056b47b38196/Makefile#L16 and
https://github.com/gratipay/inside.gratipay.com/tree/dd1491f2684bdb3c5193d5438e37056b47b38196/vendor

[edmorley]

I don't think using a vendor directory in your repo is the best fix for this.

Timeouts during first install should be fixed regardless, and slow subsequent installs shouldn't happen due to the Heroku build cache (if the packages aren't being cached, that's a bug).

As for security - the best approach is either peep (for pip <= v6.x) or once pip v8 is released, you can use the new hash feature.

[techtonik]

I'd like to have repeatable installs. For example, if we don't have a package on PyPI yet, Heroku fails. Or we need to specify full path in requirements, which will fail for system-dependent packages.

[edmorley]

I'd like to have repeatable installs. For example, if we don't have a package on PyPI yet, Heroku fails.

In this case, don't use the package name, but one of the other supported requirement specifiers to point at either a local path, VCS location, or even GitHub's auto-generated archives (example).

[techtonik]

@edmorley this doesn't allow to specify binary packages.

[edmorley]

Do you mean python packages that require compilation, but for which the necessary system libraries aren't available? If so, it sounds like the conda buildpack (see https://devcenter.heroku.com/articles/python-c-deps) is what you need.

[techtonik]

conda looks like a whole separate toolchain. I don't want to increase the complexity.

[kennethreitz]

You can specify paths in a requirements.txt file to point to a package contained within your repo.

[techtonik]

@kennethreitz yes, but binary packages require different files for different platforms.

[techtonik]

Oh well. Whatever.