I've got an idea to fill the void of the non-existent PEP 517 build requirements provisioning. The problem is that
currently there's no first-class citizen support for reproducible builds in the PEP 517 world. People usually set
lower bounds on their build backend of choice and that's about it. Even if some will set exact pins in their
pyproject.toml
, it's not enough because those entries may contain unpinned (transitive) dependencies. One way to
do this with python -m build
is to set PIP_CONSTRAINTS
environment variable (I haven't actually tested this yet
but I expect it to work).
That workaround is suboptimal and leaves the users with no answer on how to manage the invocations and the