Post #1834551

@brian @hugovk pip doesn't support installing from a lock file yet, so there's nothing for it to check ATM. And I think it makes sense to work out some common library that does the best practices here, it's just the usual questions of who and where?