use the lockfile on all items, not just the top sources.