Fresh deploy on Heroku fails with "use --allow-unverified PIL to allow"

Question

Tried deploying a Django project to a fresh app on Heroku (The code is running on other instances for past two years) - and was hit with this:

   Downloading/unpacking PIL==1.1.7 (from -r requirements.txt (line 7))

   Could not find any downloads that satisfy the requirement PIL==1.1.7 (from -r requirements.txt (line 7))

   Some insecure and unverifiable files were ignored (use --allow-unverified PIL to allow).
   Cleaning up...

   No distributions at all found for PIL==1.1.7 (from -r requirements.txt (line 7))
   Storing debug log for failure in /app/.pip/pip.log

   !     Push rejected, failed to compile Python app

I'm aware of the recent changes in pip and would like to use packages that are secure, but until all are available properly packaged as per pip's expectations, we need some workarounds. Especially the lack of --allow-all-unverified flag makes this a trial-and-error mucking about with a blackbox exercise instead of a painless deployment.

Is there a sane way to get past this roadblock? (Not just PIL, but that's the first package that failed, there are several others like pyPdf that will fail if I manage to fix just this)

Any pointers appreciated!

Answer 1

I asked the maintainer of pip, and he replied with a simple solution. I am detailing how to go about it as a response to my own question. Here is what you need to do for now - until the packages are hosted internally and verified.

On local machine, create a new virtual environment and add one line on top of the requirements.txt file:

--allow-all-external

Save it and run:

pip install -r requirements.txt --download="~/temp/packages"

What this will do is simply take every package name from requirements.txt and download the package into ~/temp/packages directory and verify it.

For every package that fails verification, add another line to requirements.txt, just below first line allowing all external packages, that goes like this:

--allow-unverified package-name

You might want to ping the maintainer to fix this ;)

Continue till pip completes successfully, then commit the updated requirements.txt to vcs and deploy.

That should be all.