Browse Teach Curate

Dependency Lock Files Pin the Whole Transitive Closure

The outcome requires the environment to be part of what is recorded. A container image freezes a build, but the recipe that produced it must itself be reproducible or the image cannot be rebuilt when it must be patched. Lock files are the vendor-neutral mechanism, and the reuse candidate shows the corpus already teaches exactly this.

jeremy Video

Pinning Transitive Dependencies with pip-compile Lock Files in Python

Deterministic (reproducible) builds require that the complete resolved dependency set of a project be fully pinned, not merely its directly declared requirements, because dependencies form a transiti…