> Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately. Build pipelines should be versioned as well. Correl

> Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately. Build pipelines should be versioned as well. Correlate the application sha with the pipeline sha and you have both sources. > And if you pull in a non-reproducible library, time will matter a lot. I'd argue that if your application is pulling in a non-reproducible library and using it, then your application won't be reproducible until you've made the libraries you're using also reproducible. Otherwise the entire idea falls apart.