3 ms·

Agree. In critical infrastructure, it's often essential to provide customers with a single fix. If you can't reproduce the build that they have, then you can't

• hinkley 6y ago
  We have an internal tool that grovels through dependencies looking for first party code, and then pulls that thread all the way to hyperlinks to the ticket numbers and the commit diffs. So not only can we build another copy with the same third party code, when we do a bug fix you can validate that you in fact only got that one change into the bugfix. Even with infrastructure to do surgery on dependencies, it's quite possible to fat finger something and get too much or not enough. So we built a sanity tool that gives the engineering sign-off prior to validation a bit of gravitas.