I mean, up until last year someone could permanently depublish entire packages from certain package managers without restriction. No amount of hash-refs are goi

I mean, up until last year someone could permanently depublish entire packages from certain package managers without restriction. No amount of hash-refs are going to ensure you have the right package if it just doesn't exist anymore. I think availability is exactly what dozzie was getting at by specifying 'production'. You want your production systems to be robust, not reliable at the whims of half a dozen different ecosystems all with different policies, procedures, humans, support agreements, etc. (This is without even touching on infrastructure availability.)