I initially created a thread about this at How to pin build dependencies but I think this may be a more productive place for it.
I wrote more about my particular problem in that thread, but to try and summarize, I would like a way to track and pin the transitive build dependencies of my project. We pin all of our runtime dependencies, but there have been multiple times in the past few months where automated builds of my project fail because a build dependency somewhere put out a bad release. There doesn’t seem to be a good way to track and pin build dependencies with Python packaging tools though.
I’m curious if others think this is a problem, can offer any advice, or if there’s any interest or progress in making pinning build dependencies possible with Python packaging tools.