#20166 Reproducible Pants install: lockfile for Pants plugin requirements Issue created by huonw Is your feature request related to a problem? Please describe. One can install extra requirements into Pants execution venv in a few ways: •

[GLOBAL].plugins

(e.g.

plugins = ["hdrhistogram"]

to get additional stats logging) • a

requirements.txt

next to

register.py

for a backend (#19406) Currently, one cannot pin these installations except by (transitively) explicit

hdhistogram==...

pinned requirements, so each install of that pants environment, such as in a CI runner, might pick-up different packages. This has problems like: • non-reproducible behaviour • breakage from new dependency releases (e.g. #18971) • potential security issues if a dependency is compromised • potentially reduced performance, because starting pants has to run dependency resolution, not just installation With the new PEX-based installations, most of Pants' own requirements are pinned (packaged into the PEX) reducing the severity of this, but this still applies to extra requirements added. In addition, potentially a first-party backend could use the

requirements.txt

-next-to-

register.py

feature. Describe the solution you'd like Some sort of pinning for the pants plugin requirements, so that one can get the same environment every time. Describe alternatives you've considered None, yet. Additional context https://pantsbuild.slack.com/archives/C01CQHVDMMW/p1699499027716209 pantsbuild/pants