build: also pin pip and setuptools

Mostly to get rid of the "you're not using the latest pip!" warning.

Author: nedbat

Makefile

@@ -72,16 +72,17 @@ metacov:				## Run meta-coverage, measuring ourself.
 metahtml:				## Produce meta-coverage HTML reports.
 	python igor.py combine_html
 
+PIP_COMPILE = pip-compile --upgrade --allow-unsafe
 upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
 upgrade: 				## update the *.pip files with the latest packages satisfying *.in files
 	pip install -q -r requirements/pip-tools.pip
-	pip-compile --upgrade -o requirements/pip-tools.pip requirements/pip-tools.in
-	pip-compile --upgrade -o requirements/pip.pip requirements/pip.in
-	pip-compile --upgrade -o requirements/pytest.pip requirements/pytest.in
-	pip-compile --upgrade -o requirements/kit.pip requirements/kit.in
-	pip-compile --upgrade -o requirements/tox.pip requirements/tox.in
-	pip-compile --upgrade -o requirements/dev.pip requirements/dev.in
-	pip-compile --upgrade -o doc/requirements.pip doc/requirements.in
+	$(PIP_COMPILE) -o requirements/pip-tools.pip requirements/pip-tools.in
+	$(PIP_COMPILE) -o requirements/pip.pip requirements/pip.in
+	$(PIP_COMPILE) -o requirements/pytest.pip requirements/pytest.in
+	$(PIP_COMPILE) -o requirements/kit.pip requirements/kit.in
+	$(PIP_COMPILE) -o requirements/tox.pip requirements/tox.in
+	$(PIP_COMPILE) -o requirements/dev.pip requirements/dev.in
+	$(PIP_COMPILE) -o doc/requirements.pip doc/requirements.in
 
 # Kitting
 

doc/requirements.pip

@@ -97,4 +97,5 @@ urllib3==1.26.7
     # via requests
 
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+setuptools==58.3.0
+    # via sphinx

requirements/dev.pip

@@ -210,4 +210,9 @@ zipp==3.6.0
     # via importlib-metadata
 
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+pip==21.3.1
+    # via -r requirements/pip.pip
+setuptools==58.3.0
+    # via
+    #   astroid
+    #   check-manifest

requirements/kit.pip

@@ -35,4 +35,5 @@ wheel==0.37.0
     # via -r requirements/kit.in
 
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+setuptools==58.3.0
+    # via -r requirements/kit.in

requirements/pip-tools.pip

@@ -16,5 +16,7 @@ wheel==0.37.0
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:
-# pip
-# setuptools
+pip==21.3.1
+    # via pip-tools
+setuptools==58.3.0
+    # via pip-tools

requirements/pip.pip

@@ -18,4 +18,5 @@ virtualenv==20.9.0
     # via -r requirements/pip.in
 
 # The following packages are considered to be unsafe in a requirements file:
-# pip
+pip==21.3.1
+    # via -r requirements/pip.in