Generate a single hash

[plannigan]

Changelog-friendly one-liner: Option to restrict generated hashes to the single best matching file

Closes #1330

Contributor checklist

• Provided the tests for the changes.
• Gave a clear one-line description in the PR (that the maintainers can add to CHANGELOG.md on release).
• Assign the PR to an existing or new milestone for the target version (following Semantic Versioning).

[plannigan]

The mypy failures in the pre-commit.ci look like they are legitimate, but not related to my changes. I am getting the same errors when running checkqa locally on the default branch.

[plannigan]

Pulled in the latest changes to the default branch and now mypy is passing. The rest of the CI is waiting for a maintainer to approve it to run.

[plannigan]

I switched to the compatibility implementation of nullcontext() which will resolve the previous failure on python 3.6.

[ssbarnea]

While I do not see myself using it, it does still LGTM, especially as the number of hashes
can become quite large for some packages.

Still, I hope others will review the change better and note if there are reasons for not doing this change.

[atugushev]

Can we postpone this to 6.3.0? There is no rush and i'd like to take a look at this later.

[atugushev]

It looks like there is an issue with existing hashes in requirements.txt. How to reproduce:

1. Generate hashes first:

$ pip-compile --generate-hashes
#
# This file is autogenerated by pip-compile with python 3.8
# To update, run:
#
#    pip-compile --generate-hashes
#
psycopg2==2.9.1 \
    --hash=sha256:079d97fc22de90da1d370c90583659a9f9a6ee4007355f5825e5f1c70dffc1fa \
    --hash=sha256:2087013c159a73e09713294a44d0c8008204d06326006b7f652bef5ace66eebb \
    --hash=sha256:2c992196719fadda59f72d44603ee1a2fdcc67de097eea38d41c7ad9ad246e62 \
    --hash=sha256:7640e1e4d72444ef012e275e7b53204d7fab341fb22bc76057ede22fe6860b25 \
    --hash=sha256:7f91312f065df517187134cce8e395ab37f5b601a42446bdc0f0d51773621854 \
    --hash=sha256:830c8e8dddab6b6716a4bf73a09910c7954a92f40cf1d1e702fb93c8a919cc56 \
    --hash=sha256:89409d369f4882c47f7ea20c42c5046879ce22c1e4ea20ef3b00a4dfc0a7f188 \
    --hash=sha256:bf35a25f1aaa8a3781195595577fcbb59934856ee46b4f252f56ad12b8043bcf \
    --hash=sha256:de5303a6f1d0a7a34b9d40e4d3bef684ccc44a49bbe3eb85e3c0bffb4a131b7c
    # via -r requirements.in

2. Then run pip-compile again with the single hash option:

$ pip-compile --generate-hashes --single-hash
#
# This file is autogenerated by pip-compile with python 3.8
# To update, run:
#
#    pip-compile --generate-hashes --single-hash
#
psycopg2==2.9.1 \
    --hash=sha256:079d97fc22de90da1d370c90583659a9f9a6ee4007355f5825e5f1c70dffc1fa \
    --hash=sha256:2087013c159a73e09713294a44d0c8008204d06326006b7f652bef5ace66eebb \
    --hash=sha256:2c992196719fadda59f72d44603ee1a2fdcc67de097eea38d41c7ad9ad246e62 \
    --hash=sha256:7640e1e4d72444ef012e275e7b53204d7fab341fb22bc76057ede22fe6860b25 \
    --hash=sha256:7f91312f065df517187134cce8e395ab37f5b601a42446bdc0f0d51773621854 \
    --hash=sha256:830c8e8dddab6b6716a4bf73a09910c7954a92f40cf1d1e702fb93c8a919cc56 \
    --hash=sha256:89409d369f4882c47f7ea20c42c5046879ce22c1e4ea20ef3b00a4dfc0a7f188 \
    --hash=sha256:bf35a25f1aaa8a3781195595577fcbb59934856ee46b4f252f56ad12b8043bcf \
    --hash=sha256:de5303a6f1d0a7a34b9d40e4d3bef684ccc44a49bbe3eb85e3c0bffb4a131b7c
    # via -r requirements.in

---

Note that --no-reuse-hashes helps to generate single hash output:

$ pip-compile --generate-hashes --no-reuse-hashes --single-hash
#
# This file is autogenerated by pip-compile with python 3.8
# To update, run:
#
#    pip-compile --generate-hashes --no-reuse-hashes --single-hash
#
psycopg2==2.9.1 \
    --hash=sha256:de5303a6f1d0a7a34b9d40e4d3bef684ccc44a49bbe3eb85e3c0bffb4a131b7c
    # via -r requirements.in

[plannigan]

Ok, that makes sense. The local repository checks the cache before calling get_hashes() for the PyPI repository. I'll have some time to circle back on this in a few days.

[plannigan]

Thanks for tracking down the hash reuse issue. The fix was a simple check to see if there were more than one existing hash.

[AndydeCleyre]

Small English changes in the readme, please:

• "give" to "given"
• "match" to "matching"

Thanks!

[plannigan]

Fixed the grammar in a few more locations in docstrings. Should be good to go now.

[ssbarnea]

Closing this PR as it seems outdated. Please try to reopen it once these problems are sorted. Small PRs that are easy to review are likely to be merged quickly as they impose less risks.