Moving off lockfile

[pradyunsg]

pip currently vendors lockfile but it is deprecated as on Oct 2017.

pip should start using some other package -- lockfile's README suggests fasteners.

[pradyunsg]

There's https://pypi.org/project/filelock, which has a very similar API and seems to be active.

[uranusjr]

Another possibility: https://pypi.org/project/portalocker/

[chrahunt]

Just a few considerations:

1. Backwards compatibility. Any change in this area would not guard against concurrent access by different pip versions, unless the existing behavior is also preserved. Is there any way around this?
2. We must refactor to lock using a different file than we write into. This is in general a good practice, but absolutely required if the underlying library is using fcntl.lockf that depends on the "Advisory Record Locking" described in fcntl(2). This for example is unsafe, since opening and closing the same file would release the lock. I know this applies to fasteners, and filelock explicitly states that users should not use the same file as a lockfile.
3. NFS compatibility. I don't think it's uncommon to have home directories shared across multiple hosts via NFS, and the default cache dir on Unixes is ~/.cache.

[pradyunsg]

@chrahunt Would you be able to make some time to work on this?