Add SHA dependency checks

[bbangert]

pip now lets us add SHA hashes to dependencies, we should use these:

• https://pip.pypa.io/en/stable/reference/pip_install/#hash-checking-mode

[pjenvey]

These can be potentially bothersome but should be worth it. You usually include a hash of the .tar.gz and a platform's .whl, but can include as many as needed

The hashin utility can produce these for us. But piptools' pip-compile may get support for what hashin does soon:

jazzband/pip-tools#303

w/ pip-compile you can keep the most bare minimum requirements in a '.in' file (a lot like what you'd have in setuptools requires).

It then version pins everything from it including all the sub dependencies. It mentions in the final requirements file where those sub dependencies are from.

e.g.:
six==1.10.0 # via autobahn, cryptography, pyopenssl, python-dateutil, python-jose, txaio

Then it has a --upgrade feature, which is similar to what pyup provides

[oberstet]

You could steel from this .. using hashin

[pjenvey]

FYI @oberstet pip-tools actually has support for handling these now (that jazzband/pip-tools#303 should be closed out). When be switch to it we'll be gaining the .in file format/upgrading and now the hash support too

[pjenvey]

We can't enable hash checks while still using editable url specs (txstatsd and temporarily crytography).

I've pinged txstatsd's lauchpad for a new release.. but will probably have to get in touch with them via some other means

[bbangert]

Once we go to Rust for connection node, we can drop txstatsd and should be able to do this.

[pjenvey]

endpoint still needs it, no?

[bbangert]

Aw right, we're still on twisted for the endpoint, doh.

[bbangert]

Won't be addressing this as we're moving entirely to Rust soonish.