More deterministic builds: can we also lock build-system.requires?

• I have searched the issues of this repo and believe that this is not a duplicate.
• I have searched the FAQ and general documentation and believe that my question is not already covered.

Some Context

On July 17th, a lot of people woke up to find out that they could no longer install PyYAML. The problem ended up not being that cython 3.0 had been released with some breaking changes.

• PyYAML issue: https://github.com/yaml/pyyaml/issues/724 and workaround (updating build-system.requires to have Cython<3.0: https://github.com/yaml/pyyaml/commit/ae08bdc82b4ddfcd2b93c8aedcd1963766c3307d
• Cython release history: https://pypi.org/project/Cython/#history
  

This affected a number of macOS developers on my team. This surprised me at first, because we use poetry, and I thought that poetry would have ensured we always build PyYAML with the same, locked version of Cython. However, looking through our lockfiles, I guess that's not the case (I see no mention of Cython whatsoever). Given that "DETERMINISTIC BUILDS" is one of the headlines on https://python-poetry.org/, I figured this is something Poetry would like to do a better job with.

Feature Request

I'd like poetry installs to be more reproducibe. If I was able to successfully run poetry install yesterday, I'd like today's poetry install to run using the exact same build-system.requires for all the packages I need to build.

Misc Thoughts

I guess what's happening is that poetry just leaves the PEP-517 isolated builds entirely in pip's hands. That is, when pip tries to build a package with a pyproject.toml like this:

[build-system]
requires = ["setuptools", "wheel", "Cython"]

pip just uses whatever the latest version of setuptools/wheel/Cython are available.

I don't know enough about pip to know if it even has a mechanism for to say "Hey, please do a PEP-517 isolated build, but for those build-system.requires, use these specific versions, thanks". If it doesn't, perhaps that's something upstream pip would be willing to add support for? (I'm happy to inquire over there if it's helpful.)

Start by reviewing how poetry install handles PEP 517 isolated builds and how build-system.requires is represented in package metadata and lockfiles. Determine whether Poetry or pip can select exact build requirements, then define completion as repeatable installs using the same build requirements for every package that must be built.