Use peep instead of pip (bug 1118379)

[magopian]

Fixes bug 1118379

Use https://pypi.python.org/pypi/peep instead of plain pip

[magopian]

@andymckay r?

Using the github archives instead of the -e git+... options seems to be working well. Instead of that, to not have to rely on github, we could simply create/use the wheels on pyrepo.

One thing to make sure though: have a recent enough version of django-mozilla-product-details (the one we had didn't have a working setup.py I believe, and thus didn't properly install).

[robhudson]

I think this should also copy the peep.py file to the repo and verify it, otherwise peep itself is the weakest link in the chain. See the peep README for this suggestion.

[andymckay]

I was going to suggest install peep off of pyrepo and then you don't need to install the rest of pyrepo. Embedding it works too.

[andymckay]

This should be pulling off pyrepo with == to specify the version, or embed it.

[magopian]

This is currently broken, I believe because of the incompatibility of peep and pip7 (eg erikrose/peep#94)

Also, I'm not sure we really need/want to use peep. It would allow us to not need pyrepo anymore, installing straight from pypi. However, we'd then have other issues (what if a package is badly updated on pypi as it happened for the python-memcached 1.53 wheel which is in fact now a 1.55 package? Or if someone removes an old version or deletes a package from pypi?).

So I believe we need to keep pyrepo, and we thus don't need peep. Thoughts @andymckay @robhudson?

[kmaglione]

I think I'd still rather have peep, even if we stick with pyrepo. We thought we were getting all of our packages from our wheelhouse before, and things still broke, and were very difficult to diagnose. If we can manage to get this working without making our lives too difficult in the future, I think it's worth it.

[andymckay]

I agree with @kmaglione, peep is worth it.

[magopian]

Closing for now: the peep bug is still open.

If this is reopened, it'll also need some more documentation around how to maintain the requirements files (updating, adding a new requirement, adding the appropriate hashes). Might need a lot of rework if #795 makes it to master (it got reverted in fa65808)