Right now Amethyst does not seem to use its dependency to xylitol, but in the future, with reproducible build systems such as Nix, it would be useful to introduce a way to lock each dependency to a specific Git commit, by producing some kind of amethyst.lock manifest.

Noticed while working on #6. I'll be able to sort out the Nix side of things.