I would include the commit metadata, otherwise you have no easy way to figure out where that source came from. The issue of out-of-VCS builds can be solved by p

I would include the commit metadata, otherwise you have no easy way to figure out where that source came from. The issue of out-of-VCS builds can be solved by putting the commit-hash into the directory/tarball name or a VERSION file, e.g. $PROJECTNAME-$(git describe --tags | sed "s/^v//"). When converting VCSs most converters will preserve the old hash in some form, e.g. by appending it to the commit message. Github downloads however remain a problem, as they just include the branch name, not the commit hash.