Tracking issue: Stabilize `uv.lock` format

[konstin]

This is a tracking issue for making breaking changes the schema and contents of uv.lock before the release.

• Remove extra duplication from lockfile #4888
• Sort dependencies before sdist in lockfile #4889
• Move the resolution options (resolution lowest, exclude newer, prerelease mode) under a newer header resolver-options to group them and make them distinct from the rest of the top level entries.
• Rename distribution to package or packages. This is not a distribution entry, the distributions are the source dists and wheels. package is also a more familiar name and closer to PEP 751, packages would be the same as PEP 751.
• If only one index is used, move the source = { registry = "https://pypi.org/simple" } to the top of the file and out of the [[distribution]]. This shrinks the file a bit and removed the duplication.
• Try to make the lockfile more concise. Could we e.g. remove redundant source line? The lockfile is long and should try to get it as small as possible without sacrificing readability and diffability.

[T-256]

• Try to make the lockfile more concise. Could we e.g. remove redundant source line?

it could use source at top-level which implies that distributions without source are using it:

version = 1
source = { registry = "https://pypi.org/simple" }
# or:
# source.registry = "https://pypi.org/simple"

[[distribution]]
name = "a"
version = "0.1.0"
sdist = { url = "https://example.com", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 0 }

[[distribution]]
name = "a"
version = "0.1.1"
sdist = { url = "https://example.com", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 0 }

[[distribution]]
name = "b"
version = "0.1.0"
source = { editable = "path/to/dir" }

sdist = { url = "https://example.com", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 0 }

Idk, but I expected checksum instead of hash. also it used by cargo.lock

• Rename sdist to source-dist.

I vote to don't change it, or source-distribution for consistency, or source-code/code/code-distribution.

[chrisrodrigue]

@T-256

This is nitpicking semantics but I think hash and checksum are often used interchangeably. I couldn't find a terrible amount of info on it but I did find this glossary definition suggesting hash is the more correct term. I think checksum reflects the intended use case of the hash, but the hash can theoretically be used as more than just a checksum.

[tinovyatkin]

Can we have an option to exclude source completely? It may include per user specific credentials in case of private registries. Something similar to NPM omit-lockfile-registry-resolved option?

[zanieb]

@tinovyatkin we're planning on redacting credentials from the lockfile (see #5119), is that going to be sufficient or is there more to your use-case?

[tinovyatkin]

@tinovyatkin we're planning on redacting credentials from the lockfile (see #5119), is that going to be sufficient or is there more to your use-case?

Unfortunately in our case we are using "authentication proxies" on developers machines (so address starts like http://127.0.0.1....) and some specific address on CI builds.

Can source at top level contain the original source where the address was obtained? Like "source": "config" or "source": "environment"?