How to build and deploy applications with locked transitive dependencies?

[stachel (Adrian Stachlewski)]

@steve.dower

If you really care, then you should vendor all your dependencies and distribute a complete package.

I don’t particularly see the benefits of using vendor packages instead of fetching them from a private package index, pinning all transitive dependencies and saving the hashes.

@steve.dower

Python-standalone-builds is a helpful project for non-Windows OS here, as they can give you pre-built CPython packages that are relocatable. Add in your app and your dependencies and you should be pretty close to a redistributable, reproducible package for your app.

I’m familiar with that project, but that’s not where the problem I’m trying to solve lies.

@steve.dower

Requirements files (and lock files) are really for consumers of your app, not for deployments. Docker works because it essentially vendors everything before you deploy - you can do the same without Docker, you just need to get familiar with how your target operating systems resolve paths.

Who exactly do you mean by “consumers” then? I’m building an application and distributing it as a wheel to internal end users. They install the application (deploy it on their servers), and I want to ensure that they install it with exactly the same dependencies (i.e., the same versions of Python packages) that I used during testing. Based on another discussion about lock files, it seems that lock files are designed specifically for this purpose.