Install python libraries with pip 20.2 and the 2020-resolver planned for the 20.3 release. See the changes to the pip dependency resolver in 20.2 (2020)

This fails for me when installing in the docker image, and when installing on macOS in a virtualenv. It succeeds when the default resolver in pip 20.2 is used.

The error with --use-feature=2020-resolver is:

ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    idna<3,>=2.5 from https://files.pythonhosted.org/packages/a2/38/928ddce2273eaa564f6f50de919327bf3a00f091b5baba8dfa9460f3a8a8/idna-2.10-py2.py3-none-any.whl#sha256=b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0 (from requests[security]==2.24.0->-r requirements/shared.txt (line 9))

Previous work was in PR #1289. Some highlights:

• https://github.com/jwhitlock/pip-resolver-demo demonstrates the issue
• The new resolver was randomly applied and broke documentation, reported and fixed
• A fix was discussed and shipped in pip 20.2.4, but didn't fix our issue
• The pip 20.2.4 issue was discussed in pip 20.2.4 with 2020 resolver does not use pinned version in the constraints file pypa/pip#9020. It is likely that the the next action is to document this as a known regression, and to discourage using hashes with constraints.

My next attempt will be to follow @willkg's strategy in mozilla-services/socorro#5595 and switch to pip-compile instead. I also need to adjust my advocacy for constraints as requirements of requirements. They are a lot less useful with the new resolver.