code: func (r PluginRequirements) LockExecutables(sha256s map[string][]byte) {
  	for name, cons := range r {
  		digest := sha256s[name]
  
  		if digest == nil {
  			// Prevent any match, which will then presumably cause the
  			// downstream consumer of this requirements to report an error.
  			cons.SHA256 = []byte(invalidProviderHash)
  			continue
  		}
  
  		cons.SHA256 = digest
  	}
  }
docs: // LockExecutables applies additional constraints to the receiver that
  // require plugin executables with specific SHA256 digests. This modifies
  // the receiver in-place, since it's intended to be applied after
  // version constraints have been resolved.
  //
  // The given map must include a key for every plugin that is already
  // required. If not, any missing keys will cause the corresponding plugin
  // to never match, though the direct caller doesn't necessarily need to
  // guarantee this as long as the downstream code _applying_ these constraints
  // is able to deal with the non-match in some way.