# Structured, Exchangeable lock file format (requirements.txt 2.0?)

**URL:** <https://discuss.python.org/t/structured-exchangeable-lock-file-format-requirements-txt-2-0/876>\
**Category:** Packaging\
**Created:** [February 12, 2019, 8:37am UTC](https://discuss.python.org/t/structured-exchangeable-lock-file-format-requirements-txt-2-0/876 "2019-02-12T08:37:12Z")\
**Posts on this page:** 1\
**Showing post:** 63

<div class="post-metadata">

**Author:** ![FRidh](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fridh/32/10749_2.png) [@FRidh](https://discuss.python.org/u/FRidh)\
**Post date:** [August 5, 2019, 5:31pm UTC](https://discuss.python.org/t/structured-exchangeable-lock-file-format-requirements-txt-2-0/876/63 "2019-08-05T17:31:42Z")

</div>

> [@brettcannon](#):
>
> Correct, but that’s by design. Historically the Python community has favoured cross-platform support over reproducibility. But if the tools were updated to allow an opt-in flag to lock only the files used would that give you the reproducibility you’re after?

Yes, it would. But it could always do that _as well_, by simply recording a list of hashes that were used; it just needs to be done _per platform_.

To summarize what I would like to see in a lock file:

- For each artifact:  
– url(s) so it is possible to fetch  
– name of artifact (basename of url). That allows us to identify the type of artifact, and to provide the artifact when not able to fetch  
– hash
- list with hashes, that were _actually_ used when generating the lock file, so it is possible to achieve reproducibility.

Now, there is still the issue of platform. The list of hashes that were used are those for a specific platform (and Python version but because we’re considering applications and not development environments we lock that and thus that is not relevant). What now, if we want to support multiple platforms? We could have a list per platform, and lock it per platform. That means multiple runs and the risk of unnecessarily getting different versions of dependencies across platforms due to a change of state. This is a big issue that’s been blocking us also from further automating our package set creation in Nixpkgs.

---

_[View the full topic](https://discuss.python.org/t/structured-exchangeable-lock-file-format-requirements-txt-2-0/876)._