build: use .in from .in

We build the .pip files on Mac.  Some transitive dependencies are
different on other OS's, and so would fail there, like this:

```
ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    SecretStorage>=3.2 from https://files.pythonhosted.org/packages/54/24/b4293291fa1dd830f353d2cb163295742fa87f179fcc8a20a306a81978b7/SecretStorage-3.3.3-py3-none-any.whl#sha256=f356e6628222568e3af06f2eba8df495efa13b3b63081dafd4f7d9a7b7bc9f99 (from keyring==23.13.1->-r requirements/dev.pip (line 279))
```

By keeping the .in files self-contained, we provide a way to install
without hashes.

Author: nedbat

doc/contributing.rst

@@ -50,6 +50,11 @@ these steps:
 
     $ python3 -m pip install -r requirements/dev.pip
 
+    If this fails due to incorrect or missing hashes, use
+    ``dev.in`` instead::
+
+    $ python3 -m pip install -r requirements/dev.in
+
 #.  Install a number of versions of Python.  Coverage.py supports a range
     of Python versions.  The more you can test with, the more easily your code
     can be used as-is.  If you only have one version, that's OK too, but may

requirements/dev.in

@@ -5,11 +5,11 @@
 # "make upgrade" turns this into requirements/dev.pip.
 
 -c pins.pip
--r pip.pip
+-r pip.in
 
 # PyPI requirements for running tests.
--r tox.pip
--r pytest.pip
+-r tox.in
+-r pytest.in
 
 # for linting.
 check-manifest

requirements/dev.pip

@@ -12,7 +12,6 @@ attrs==22.2.0 \
     --hash=sha256:29e95c7f6778868dbd49170f98f8818f78f3dc5e0e37c0b1f474e3561b240836 \
     --hash=sha256:c9227bfc2f01993c03f68db37d1d15c9690188323c067c641f1a35ca58185f99
     # via
-    #   -r requirements/pytest.pip
     #   hypothesis
     #   pytest
 bleach==6.0.0 \
@@ -26,19 +25,15 @@ build==0.10.0 \
 cachetools==5.3.0 \
     --hash=sha256:13dfddc7b8df938c21a940dfa6557ce6e94a2f1cdfa58eb90c805721d58f2c14 \
     --hash=sha256:429e1a1e845c008ea6c85aa35d4b98b65d6a9763eeef3e37e92728a12d1de9d4
-    # via
-    #   -r requirements/tox.pip
-    #   tox
+    # via tox
 certifi==2022.12.7 \
     --hash=sha256:35824b4c3a97115964b408844d64aa14db1cc518f6562e8d7261699d1350a9e3 \
     --hash=sha256:4ad3232f5e926d6718ec31cfc1fcadfde020920e278684144551c91769c7bc18
     # via requests
 chardet==5.1.0 \
     --hash=sha256:0d62712b956bc154f85fb0a266e2a3c5913c2967e00348701b32411d6def31e5 \
     --hash=sha256:362777fb014af596ad31334fde1e8c327dfdb076e1960d1694662d46a6917ab9
-    # via
-    #   -r requirements/tox.pip
-    #   tox
+    # via tox
 charset-normalizer==3.1.0 \
     --hash=sha256:04afa6387e2b282cf78ff3dbce20f0cc071c12dc8f685bd40960cc68644cfea6 \
     --hash=sha256:04eefcee095f58eaabe6dc3cc2262f3bcd776d2c67005880894f447b3f2cb9c1 \
@@ -128,8 +123,8 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   -r requirements/pytest.pip
-    #   -r requirements/tox.pip
+    #   -r requirements/pytest.in
+    #   -r requirements/tox.in
     #   tox
 dill==0.3.6 \
     --hash=sha256:a07ffd2351b8c678dfc4a856a3005f8067aea51d6ba6c700796a4d9e280f39f0 \
@@ -138,10 +133,7 @@ dill==0.3.6 \
 distlib==0.3.6 \
     --hash=sha256:14bad2d9b04d3a36127ac97f30b12a19268f211063d8f8ee4f47108896e11b46 \
     --hash=sha256:f35c4b692542ca110de7ef0bea44d73981caeb34ca0b9b6b2e6d7790dda8f80e
-    # via
-    #   -r requirements/pip.pip
-    #   -r requirements/tox.pip
-    #   virtualenv
+    # via virtualenv
 docutils==0.19 \
     --hash=sha256:33995a6753c30b7f577febfc2c50411fec6aac7f7ffeb7c4cfe5991072dcf9e6 \
     --hash=sha256:5e1de4d849fee02c63b040a4a3fd567f4ab104defd8a5511fbbc24a8a017efbc
@@ -150,27 +142,22 @@ exceptiongroup==1.1.1 \
     --hash=sha256:232c37c63e4f682982c8b6459f33a8981039e5fb8756b2074364e5055c498c9e \
     --hash=sha256:d484c3090ba2889ae2928419117447a14daf3c1231d5e30d0aae34f354f01785
     # via
-    #   -r requirements/pytest.pip
     #   hypothesis
     #   pytest
 execnet==1.9.0 \
     --hash=sha256:8f694f3ba9cc92cab508b152dcfe322153975c29bda272e2fd7f3f00f36e47c5 \
     --hash=sha256:a295f7cc774947aac58dde7fdc85f4aa00c42adf5d8f5468fc630c1acf30a142
-    # via
-    #   -r requirements/pytest.pip
-    #   pytest-xdist
+    # via pytest-xdist
 filelock==3.9.0 \
     --hash=sha256:7b319f24340b51f55a2bf7a12ac0755a9b03e718311dac567a0f4f7fabd2f5de \
     --hash=sha256:f58d535af89bb9ad5cd4df046f741f8553a418c01a7856bf0d173bbc9f6bd16d
     # via
-    #   -r requirements/pip.pip
-    #   -r requirements/tox.pip
     #   tox
     #   virtualenv
 flaky==3.7.0 \
     --hash=sha256:3ad100780721a1911f57a165809b7ea265a7863305acb66708220820caf8aa0d \
     --hash=sha256:d6eda73cab5ae7364504b7c44670f70abed9e75f77dd116352f662817592ec9c
-    # via -r requirements/pytest.pip
+    # via -r requirements/pytest.in
 greenlet==2.0.2 \
     --hash=sha256:03a8f4f3430c3b3ff8d10a2a86028c660355ab637cee9333d63d66b56f09d52a \
     --hash=sha256:0bf60faf0bc2468089bdc5edd10555bab6e85152191df713e2ab1fcc86382b5a \
@@ -236,7 +223,7 @@ greenlet==2.0.2 \
 hypothesis==6.68.2 \
     --hash=sha256:2a41cc766cde52705895e54547374af89c617e8ec7bc4186cb7f03884a667d4e \
     --hash=sha256:a7eb2b0c9a18560d8197fe35047ceb58e7e8ab7623a3e5a82613f6a2cd71cffa
-    # via -r requirements/pytest.pip
+    # via -r requirements/pytest.in
 idna==3.4 \
     --hash=sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4 \
     --hash=sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2
@@ -245,8 +232,6 @@ importlib-metadata==6.0.0 \
     --hash=sha256:7efb448ec9a5e313a57655d35aa54cd3e01b7e1fbcf72dce1bf06119420f5bad \
     --hash=sha256:e354bedeb60efa6affdcc8ae121b73544a7aa74156d047311948f6d711cd378d
     # via
-    #   -r requirements/pip.pip
-    #   -r requirements/pytest.pip
     #   build
     #   keyring
     #   pluggy
@@ -261,9 +246,7 @@ importlib-resources==5.12.0 \
 iniconfig==2.0.0 \
     --hash=sha256:2d91e135bf72d31a410b17c16da610a82cb55f6b0477d1a902134b24a455b8b3 \
     --hash=sha256:b6a85871a79d2e3b22d2d1b94ac2824226a63c6b741c88f7ae975f18b6778374
-    # via
-    #   -r requirements/pytest.pip
-    #   pytest
+    # via pytest
 isort==5.11.5 \
     --hash=sha256:6be1f76a507cb2ecf16c7cf14a37e41609ca082330be4e3436a18ef74add55db \
     --hash=sha256:ba1d72fb2595a01c7895a5128f9585a5cc4b6d395f1c8d514989b9a7eb2a8746
@@ -345,8 +328,6 @@ packaging==23.0 \
     --hash=sha256:714ac14496c3e68c99c29b00845f7a2b85f3bb6f1078fd9f72fd20f0570002b2 \
     --hash=sha256:b6ad297f8907de0fa2fe1ccbd26fdaf387f5f47c7275fedf8cce89f99446cf97
     # via
-    #   -r requirements/pytest.pip
-    #   -r requirements/tox.pip
     #   build
     #   pudb
     #   pyproject-api
@@ -364,17 +345,13 @@ platformdirs==3.1.1 \
     --hash=sha256:024996549ee88ec1a9aa99ff7f8fc819bb59e2c3477b410d90a16d32d6e707aa \
     --hash=sha256:e5986afb596e4bb5bde29a79ac9061aa955b94fca2399b7aaac4090860920dd8
     # via
-    #   -r requirements/pip.pip
-    #   -r requirements/tox.pip
     #   pylint
     #   tox
     #   virtualenv
 pluggy==1.0.0 \
     --hash=sha256:4224373bacce55f955a878bf9cfa763c1e360858e330072059e10bad68531159 \
     --hash=sha256:74134bbf457f031a36d68416e1509f34bd5ccc019f0bcc952c7b909d06b37bd3
     # via
-    #   -r requirements/pytest.pip
-    #   -r requirements/tox.pip
     #   pytest
     #   tox
 pudb==2022.1.3 \
@@ -394,9 +371,7 @@ pylint==2.17.0 \
 pyproject-api==1.5.1 \
     --hash=sha256:435f46547a9ff22cf4208ee274fca3e2869aeb062a4834adfc99a4dd64af3cf9 \
     --hash=sha256:4698a3777c2e0f6b624f8a4599131e2a25376d90fe8d146d7ac74c67c6f97c43
-    # via
-    #   -r requirements/tox.pip
-    #   tox
+    # via tox
 pyproject-hooks==1.0.0 \
     --hash=sha256:283c11acd6b928d2f6a7c73fa0d01cb2bdc5f07c57a2eeb6e83d5e56b97976f8 \
     --hash=sha256:f271b298b97f5955d53fb12b72c1fb1948c22c1a6b70b315c54cedaca0264ef5
@@ -405,12 +380,12 @@ pytest==7.2.2 \
     --hash=sha256:130328f552dcfac0b1cec75c12e3f005619dc5f874f0a06e8ff7263f0ee6225e \
     --hash=sha256:c99ab0c73aceb050f68929bc93af19ab6db0558791c6a0715723abe9d0ade9d4
     # via
-    #   -r requirements/pytest.pip
+    #   -r requirements/pytest.in
     #   pytest-xdist
 pytest-xdist==3.2.1 \
     --hash=sha256:1849bd98d8b242b948e472db7478e090bf3361912a8fed87992ed94085f54727 \
     --hash=sha256:37290d161638a20b672401deef1cba812d110ac27e35d213f091d15b8beb40c9
-    # via -r requirements/pytest.pip
+    # via -r requirements/pytest.in
 readme-renderer==37.3 \
     --hash=sha256:cd653186dfc73055656f090f227f5cb22a046d7f71a841dfa305f55c9a513273 \
     --hash=sha256:f67a16caedfa71eef48a31b39708637a6f4664c4394801a7b0d6432d13907343
@@ -443,15 +418,11 @@ six==1.16.0 \
 sortedcontainers==2.4.0 \
     --hash=sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88 \
     --hash=sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0
-    # via
-    #   -r requirements/pytest.pip
-    #   hypothesis
+    # via hypothesis
 tomli==2.0.1 \
     --hash=sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc \
     --hash=sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f
     # via
-    #   -r requirements/pytest.pip
-    #   -r requirements/tox.pip
     #   build
     #   check-manifest
     #   pylint
@@ -467,12 +438,12 @@ tox==4.4.7 \
     --hash=sha256:52c92a96e2c3fd47c5301e9c26f5a871466133d5376958c1ed95ef4ff4629cbe \
     --hash=sha256:da10ca1d809b99fae80b706b9dc9656b1daf505a395ac427d130a8a85502d08f
     # via
-    #   -r requirements/tox.pip
+    #   -r requirements/tox.in
     #   tox-gh
 tox-gh==1.0.0 \
     --hash=sha256:9cfbaa927946887d53bc19ae86621f4e5dc8516f3771ba4e74daeb1a1775efcd \
     --hash=sha256:bda94ac15dbb62ef1e517672c05f8039faad5afaf9d1b4c9fa32d07f18027571
-    # via -r requirements/tox.pip
+    # via -r requirements/tox.in
 twine==4.0.2 \
     --hash=sha256:929bc3c280033347a00f847236564d1c52a3e61b1ac2516c97c48f3ceab756d8 \
     --hash=sha256:9e102ef5fdd5a20661eb88fad46338806c3bd32cf1db729603fe3697b1bc83c8
@@ -507,8 +478,6 @@ typing-extensions==4.5.0 \
     --hash=sha256:5cb5f4a79139d699607b3ef622a1dedafa84e115ab0024e0d9c044a9479ca7cb \
     --hash=sha256:fb33085c39dd998ac16d1431ebc293a8b3eedd00fd4a32de0ff79002c19511b4
     # via
-    #   -r requirements/pip.pip
-    #   -r requirements/pytest.pip
     #   astroid
     #   importlib-metadata
     #   markdown-it-py
@@ -534,8 +503,7 @@ virtualenv==20.21.0 \
     --hash=sha256:31712f8f2a17bd06234fa97fdf19609e789dd4e3e4bf108c3da71d710651adbc \
     --hash=sha256:f50e3e60f990a0757c9b68333c9fdaa72d7188caa417f96af9e52407831a3b68
     # via
-    #   -r requirements/pip.pip
-    #   -r requirements/tox.pip
+    #   -r requirements/pip.in
     #   tox
 webencodings==0.5.1 \
     --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
@@ -622,19 +590,18 @@ zipp==3.15.0 \
     --hash=sha256:112929ad649da941c23de50f356a2b5570c954b65150642bccdd66bf194d224b \
     --hash=sha256:48904fc76a60e542af151aded95726c1a5c34ed43ab4134b597665c86d7ad556
     # via
-    #   -r requirements/pip.pip
-    #   -r requirements/pytest.pip
     #   importlib-metadata
     #   importlib-resources
 
 # The following packages are considered to be unsafe in a requirements file:
 pip==23.0.1 \
     --hash=sha256:236bcb61156d76c4b8a05821b988c7b8c35bf0da28a4b614e8d6ab5212c25c6f \
     --hash=sha256:cd015ea1bfb0fcef59d8a286c1f8bebcb983f6317719d415dc5351efb7cd7024
-    # via -r requirements/pip.pip
+    # via -r requirements/pip.in
 setuptools==65.7.0 \
     --hash=sha256:4d3c92fac8f1118bb77a22181355e29c239cabfe2b9effdaa665c66b711136d7 \
     --hash=sha256:8ab4f1dbf2b4a65f7eec5ad0c620e84c34111a68d3349833494b9088212214dd
     # via
-    #   -r requirements/pip.pip
+    #   -c requirements/pins.pip
+    #   -r requirements/pip.in
     #   check-manifest