Lock files, again (but this time w/ sdists!)

[ofek (Ofek Lev)]

Quoting myself, it looks like this proposal provides level 6 out of 7 reproducibility:

@ofek

The following describes how to define the environment in increasingly reproducible ways:

1. Depend on django
2. Depend on django==x.y.z
3. Same as before but now you resolve all transitive dependencies for your specific setup (Python version, OS, architecture, etc.) yielding precise version pins for the entire graph
4. Same as before but now you add info so as to specifically allow for targeting of other setups (whether that is specific setups or enough info for all setups)
5. Same as before but now rather than pins you store the precise URL which with the artifact is stored without support for source distributions (PEP 665)
6. Same as before but now source distributions are supported which requires in most cases downloading the artifact and invoking its chosen build backend to find out the metadata which then triggers a recursive loop where it could define dependencies that also happen to resolve to source distributions
7. Same as before but now also whenever a source distribution is encountered you resolve its build dependencies in the same way and store that data in a separate section