Fix broken development setup

This removes circular dependency in Makefile added in pypi#10278

Unblocks pypi#10052
Fixes pypi#10446
Fixes pypi#10447

Author: abitrolly

Makefile

@@ -44,10 +44,15 @@ default:
 	@echo
 	@exit 1
 
-.state/env/pyvenv.cfg: requirements/dev.txt requirements/docs.txt requirements/lint.txt requirements/ipython.txt
-	# Create our Python 3.8 virtual environment
+.state/env/01bootstrap: requirements/bootstrap.txt
+	# Create Python 3.8 virtual environment with `pip-compile` for updating
+	# dependecy hashes
 	rm -rf .state/env
 	python3.8 -m venv .state/env
+	.state/env/bin/python -m pip install -r requirements/bootstrap.txt
+	touch .state/env/01bootstrap
+
+.state/env/02install: .state/env/01bootstrap requirements/dev.txt requirements/docs.txt requirements/lint.txt requirements/ipython.txt
 
 	# install/upgrade general requirements
 	.state/env/bin/python -m pip install --upgrade pip setuptools wheel
@@ -127,7 +132,7 @@ deps: .state/env/pyvenv.cfg
 	rm -r $(TMPDIR)
 	$(BINDIR)/pip check
 
-requirements/%.txt: requirements/%.in .state/env/pyvenv.cfg
+requirements/%.txt: requirements/%.in .state/env/01bootstrap
 	$(BINDIR)/pip-compile --allow-unsafe --generate-hashes --output-file=$@ $<
 
 fix-google-deps:

requirements/bootstrap.txt

@@ -0,0 +1,20 @@
+#
+# Securely installing `pip-compile` for regenerating dependencies.
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --generate-hashes --output-file=requirements/boot.txt -
+#
+click==7.1.2 \
+    --hash=sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a \
+    --hash=sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc
+    # via pip-tools
+pip-tools==5.5.0 \
+    --hash=sha256:10841c1e56c234d610d0466447685b9ea4ee4a2c274f858c0ef3c33d9bd0d985 \
+    --hash=sha256:cb0108391366b3ef336185097b3c2c0f3fa115b15098dafbda5e78aef70ea114
+    # via -r -
+
+# WARNING: The following packages were not pinned, but pip requires them to be
+# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag.
+# pip