Choose the dependency workflow used by the project and confirm the target Python version and platform. Keep package-source credentials separate from the dependency file.

1. Resolve and review the application’s dependency set in development, including transitive requirements where the selected locking workflow records them.

2. Use pinned versions or the project’s supported lock format during a clean installation. Keep development and production dependency groups deliberate.

3. For workflows requiring stronger artifact verification, use supported hashes or a controlled wheel collection and understand the platform tags involved.

4. Install into a fresh application environment with the approved package index configuration. Avoid mixing unrelated old packages into the release environment.

5. Run the application checks and record the resulting dependency state with the release artifact.

If your project’s dependency workflow produces a complete pinned and hashed requirements.lock, install it into a fresh compatible virtual environment. The file must contain the full required dependency set and valid hashes for the approved artifacts.

.venv/bin/python -m pip install --require-hashes -r requirements.lock
.venv/bin/python -m pip check

Do not invent hash values or remove the verification flag when an unexpected artifact appears. Review whether the lock targets the actual Python version, operating system and architecture. Keep package-index credentials in protected configuration, outside the lock file and public build output. A clean dependency check also does not replace the application’s own functional verification.

Expected result: A repeat build installs the intended packages, rejects an unapproved or incompletely specified artifact, and reports no incompatible installed requirements. The deployed application then passes its representative startup and customer-workflow checks.

Repeat the install in a clean compatible environment and confirm the expected versions and behavior. Verify native wheels fit the actual interpreter and operating platform.

If resolution changes unexpectedly, review unconstrained dependencies and package-index configuration. A requirements file containing only a few direct minimum versions may not fully specify a repeatable release.

• Using a Python virtual environment for each application
• Investigating Python packages that need native libraries
• Updating a dependency with a staged compatibility test
• Separating development and production dependency groups

• pip repeatable installs
• pip secure installs

• pip check command