# Pinned build backend for reproducible release wheels.
#
# Wheels record `Generator: hatchling <version>` in `.dist-info/WHEEL`, so the
# backend version is part of the archive's content. With the unpinned
# `requires = ["hatchling>=1.32.0"]` build requirement in pyproject.toml, two
# machines that resolve different hatchling versions produce different bytes
# for identical source — which would make byte-for-byte reproducibility
# impossible and turn the source-to-wheel binding in
# scripts/verify_wheel_provenance.py into a spurious release blocker.
#
# Both sides of that comparison must build with this backend — the
# qualification promotion flow that produces the signed, qualified wheel *and*
# the release verification job that rebuilds from the tagged source:
#
#     python -m pip install --require-hashes -r constraints/build-backend.txt
#     python -m build --wheel --no-isolation
#
# Install it, then build without isolation. `PIP_CONSTRAINT` pointing here is
# *not* sufficient on current pip: constraints are not applied to an isolated
# build environment, so a constrained build silently resolves whatever the
# index offers. See docs/release-runbook.md.
#
# Bumping this pin changes the wheel bytes. A qualified wheel produced before
# the bump will no longer match, so re-run qualification after any change here.
#
# Deliberately hand-maintained: this is one pin chosen for a reproducibility
# argument, not a resolved closure, so scripts/update_locks.py leaves it alone.
# The same version is pinned inside constraints/release-seal.txt, which is what
# the sealing job actually installs; scripts/verify_dependency_lock.py and the
# release-pipeline suite keep the two in agreement.
hatchling==1.32.0
