I was going to say that pinning hashes seems to be painful, but since I last looked it now has a --generate-hashes flag.
Also if you want to link directly to a git repo, you can only install it in editable mode, you can't just install it with the rest of your packages (means you get a `src` directory where you ran pip, which makes Dockerizing slightly annoying, and probably impacts performance slightly).
Maybe this has also been fixed since I last upgraded.
