Include hash/checksum for dependencies in lock file

[mjambon]

opam lock produces a lock file (.locked) which looks like this:

...
depends: [
  "ANSITerminal" {= "0.8.2"}
  "alcotest" {= "1.5.0"}
  "astring" {= "0.8.5"}
  "atd" {= "2.2.1"}
  "atdgen" {= "2.2.1"}
  "atdgen-runtime" {= "2.2.1"}
  "base-bigarray" {= "base"}
  "base-bytes" {= "base"}
  "base-threads" {= "base"}
...

For security reasons, we would like a way to check not just the version of all the transitive dependencies but also check their contents against a checksum. Is this possible?

[kit-ty-kate]

It’s not possible with a lock file in the current state of things.
However I believe opam switch export --freeze is what you are looking for.

[mjambon]

opam switch export --freeze could help but it requires the current switch to be clean i.e. specific to the project. Maybe there's an easy way to use one switch per project? Alternatively, filtering the switch export to keep only the dependencies found in the lock file should work if there's an easy way to do so.