add support for no-index, requirements files, and repo paths

[georgeliaw]

Needed to update the pex_binary rules to keep the clutter down in the BUILD files and make them easier to maintain. Figured I should open a PR in case you would like to pull this into master.

[benley]

Thank you for the contribution! This looks good, I just have a few questions.

[benley]

Would it work to allow source distributions in repos along with eggs and wheels? That could be very convenient at times.

[benley]

Also technically one can specify https URLs pointing at a package repository with --repos. It's not a great practice with regard to Bazel, but I know people will want to do that... Thoughts?

[georgeliaw]

@benley added support for source distributions as well as cache disabling.

Have some mixed feelings about supporting URLs for the same reason that it's not exactly great practice. I'll think on the issue a bit this week.

[benley]

Wow, I wonder how this ever worked on MacOS - did mktemp's behaviour change in a recent macos release?

[georgeliaw]

@benley yeah this was a weird one, it appears the behavior was fixed to match gnu in OS X 10.11, but older versions of OS X require the -t flag. Only encountered it due to a coworker running into this issue.

https://unix.stackexchange.com/questions/30091/fix-or-alternative-for-mktemp-in-os-x

[georgeliaw]

@benley gave the URL --repo some thought. I think there's more complexity to that task than would fit into the scope of this PR. For the time being, users should be able to pull packages in via http_file in their workspace (possibly wrap it up into a filegroup) and load it into either the eggs or repos params. Have not tried that out myself, but this way they would be able to benefit from checksum enforcement.

Anything nicer would probably require writing new workspace rules for like pypi_server to set the url and pypi_package to set package name/checksum. Not sure that work is worth doing at the moment if we can use the workaround above.

For the time being, we can consider the PR ready to merge unless there are any changes you would like me to make.

EDIT: I see we both seem to agree on new workspace rules being the nicer option to implement from looking at #20. We can probably look at that at a later point in time.

[georgeliaw]

@benley I just recalled that requirements files themselves can be used to point to other repo urls, so technically this is already supported. Again, obviously not the greatest practice when it comes to Bazel, but the use-case is available.
https://pip.pypa.io/en/stable/reference/pip_install/#requirements-file-format

Pip since version 8.0 also supports hash checking, which we could try enforcing to improve the build determinism:
https://pip.pypa.io/en/stable/reference/pip_install/#hash-checking-mode

This technically means we wouldn't have to go down the workspace rule route.

What are your thoughts on this?

[benley]

Oh cool, that is a good point. I completely forgot about this PR, sorry about that!