Is your feature request related to a problem? Please describe.

When adding a dependency from a (private) Git repository, pdm.lock records the commit revision hash. Yet, when installing the dependency, in another project, PDM always pulls in HEAD, regardless of the set revision hash.

Apologies in advance if this is really an underlying problem with pip and not PDM, or if there is a smarter way to go about this, maybe someone can point me in a better direction.

Describe the solution you'd like

Wouldn't it be desirable to have PDM/pip git checkout the revision recorded in pdm.lock whenever the dependency is installed, and then only pull in HEAD when pdm update is called?

Edit: #488 (comment) this comment looks like this is the right way to do what I'm looking for rather than through pdm.lock.