PEP 665, take 2 -- A file format to list Python dependencies for reproducibility of an application

[brettcannon]

@mdrissi

If locker is allowed to reject an input file that includes relative paths

There also allowed to accept, so I’m not quite sure where your relative path concern comes from?

@mdrissi

And what do I gain from doing these workarounds vs using pip-compile and turning off hashes?

What do you directly gain? Possibly nothing if the community doesn’t adopt the PEP. But if it does then you get a standard on how to specify what to install.

But I would also urge you to not turn off hashes as that’s a security hole.

@EpicWink

I’m happy with sdist support being simply building sdists and checking the resultant wheel matches against the hash (if that’s possible).

Yes, that would be possible. That’s effectively what the pin file proposal at A file format to list Python dependencies of an application without strict reproducibility guarantees is doing.