How should a lockfile PEP (665 successor) look like?

[CAM-Gerlach]

@pf_moore

(One case I recall is projects depending on numpy need to be built with the same version that is used at runtime - they have workarounds to ensure this, but I get the impression it’s all a bit tricky and fragile).

More specifically, if I also recall correctly, they need to be built with the oldest version of NumPy they want to support at runtime, and then can be run with any backward-compatible later version of NumPy. Much like, as @brettcannon said, an API target (e.g. macOS, Android, Windows SDK targets, and also like HPy is doing and sort of like the min version in the limited API/stable ABI for CPython.

EDIT: See @rgommers 's just-posted message on another thread:

https://discuss.python.org/t/allow-package-references-as-version-specifiers/19226/18?u=cam-gerlach

which goes into more detail about this.

@brettcannon

But you’re right, scientific projects do sometimes treat numpy as an API target, hence conda supporting metadata to specify that sort of requirement.

And also a whole infrastructure around Conda-Forge, conda-build, conda-smithy, recipies, feedstocks and CI designed around those requirements, and taking care of providing a consistent set of build dependencies such that the various packages (at least built around the same time) will be ABI-compatible with each other.