> I don't see why a commit hash in insufficient to declare a package reproducible. I didn't say it wasn't sufficient. The problem is that you need to find this

> I don't see why a commit hash in insufficient to declare a package reproducible. I didn't say it wasn't sufficient. The problem is that you need to find this hash, and there's no way to do it. See this issue and discussion there: https://github.com/NixOS/nixpkgs/issues/93327 https://github.com/NixOS/nixpkgs/issues/93327