Add the ability to pin docker image tags (this isn't consumed yet)

bin/update_constraints

@@ -1,12 +1,51 @@
-#!/bin/bash
+#!/usr/bin/env python3
 
-cd "$(dirname "$0")"
-cd ..
+import os, subprocess, requests, configparser
+from collections import namedtuple
 
-export CUSTOM_COMPILE_COMMAND="bin/update_constraints"
+os.chdir(os.path.dirname(__file__))
+os.chdir('..')
 
-pip-compile \
-    --allow-unsafe \
-    --generate-hashes \
-    --upgrade \
-    cibuildwheel/resources/constraints.in
+os.environ['CUSTOM_COMPILE_COMMAND'] = "bin/update_constraints"
+subprocess.check_call([
+    'pip-compile',
+    '--allow-unsafe',
+    '--generate-hashes',
+    '--upgrade',
+    'cibuildwheel/resources/constraints.in',
+])
+
+Image = namedtuple('Image', ['manylinux_version', 'arch'])
+
+images = [
+    Image('manylinux1', 'x86_64'), Image('manylinux1', 'i686'), 
+    Image('manylinux2010', 'x86_64'), Image('manylinux2010', 'i686'), 
+    Image('manylinux2014', 'x86_64'), Image('manylinux2014', 'i686'), 
+]
+
+config = configparser.ConfigParser()
+
+for image in images:
+    repository_name = '{}_{}'.format(image.manylinux_version, image.arch)
+    quay_api_url = 'https://quay.io/api/v1/repository/pypa/{}?includeTags=true'.format(repository_name)
+    repo_info = requests.get(quay_api_url).json()
+    tags_dict = repo_info['tags']
+
+    latest_tag = tags_dict.pop('latest')
+
+    # find the tag whose manifest matches 'latest'
+    tag_name = next(
+        name 
+        for (name, info) in tags_dict.items() 
+        if info['manifest_digest'] == latest_tag['manifest_digest']
+    )
+
+    image_name = 'quay.io/pypa/{}_{}:{}'.format(image.manylinux_version, image.arch, tag_name)
+
+    if not config.has_section(image.manylinux_version):
+        config[image.manylinux_version] = {}
+
+    config[image.manylinux_version][image.arch] = image_name
+
+with open('cibuildwheel/resources/pinned_docker_images.cfg', 'w') as f:
+    config.write(f)