http://nvie.com/posts/pin-your-packages/
Although this setup still requires other steps to ensure deterministic builds.

Note: This requirements file is only used during development.