Should install-pdm.py use PDM's own lock file?

[dranjan]

Obviously there's a chicken-and-egg bootstrapping problem, because PDM wouldn't be available at that point to process the lock file. My question is whether the end goal is correct, that most users would want to lock all of PDM's dependencies to the fixed versions that are the most thoroughly tested. This occurred to me because of #1883, which was easy enough to work around, but it did get me thinking about other possible solutions.

I would think "yes," since PDM is primarily used as a command-line application, so most users shouldn't care about any of PDM's dependencies under the hood. There are also plugins to consider, though, which may pull in their own dependencies and could potentially cause issues.

[frostming]

Sounds a good idea. We can learn from get-pip.py to provision a zipped PDM distribution uploaded to https://pdm.fming.dev to process that lockfile.