Lock files, again (but this time w/ sdists!)

Yes, agreed. But what if we did produce a PEP for that? Distinct from this one naturally.

There’s been interest in blocking open-ended releases in the past Restricting "open ended" releases on PyPI?

Where it’s often from a security point of view. There is also a comment about how poetry ignores old releases for efficiency reasons.

I don’t know if there’s ever been discussions about a “max_time” anywhere though.

Might neatly avoid the debates about storing or standardising these projections in the short term and the existing tools can continue to store their existing scraped data in the “tool” section.

Then the rest of the proposal to standardise the “lock”/installation plan (no SAT solver) could remain a lot simpler.

1 Like