[quacker]

This entire article is a strawman. It fails to even understand the basic important problem lock files try to address.

Sure, I can deterministically resolve the same X.Y.Z versions of packages according to whatever algorithm I like.

But literally everything is mutable (read: can be compromised). Package managers, bytes flying over the network, build servers - all mutable. A published version of a package can be overwritten. Some package managers allow authors to overwrite existing versions.

That means no guarantee of reproducibility. I build again the next day, and I may not download the same code for the same X.Y.Z version of a package. Or my local cached packages may have changed.

So I need checksums on packages. Then I can prove I have the exact same code in those packages. And if I have checksums on packages, I have a lock file.

> lockfiles are an absolutely unnecessary concept that complicates things without a good reason

What is even the complication? The lock file is autogenerated on a successful build and I commit it. It's trivial to use. It's literally all benefit and no downside.