deterministic builds are good, but i think the issue people are seeing with this is that it's like setup.py, in that it's not easily parsable without the full p

deterministic builds are good, but i think the issue people are seeing with this is that it's like setup.py, in that it's not easily parsable without the full python interpreter. We could already have a requirements.lock. in fact, there's already a library for this called pip-tools (https://github.com/nvie/pip-tools https://github.com/nvie/pip-tools) that generates a requirements.txt (the lock file) from a requirements.in (your direct dependencies)