What would you consider a sensible solution? What about * Pip-tools(requirements.in + requirements.txt) * Poetry (pyproject.toml+poetry.lock) * Pipenv(Pipfile+Pipfile.lock)

Those and others enable easy declaration of direct dependencies and compile (resolve) a lock file of the actual dependency graph with hashes. Those tools have their issues and idiosyncrasies, but the dependency declaration aspect seems sensible and functional.