Cargo and crates.io have been specifically designed to be reliably reproducible, and had a chance to learn from npm's mistakes to not repeat them. Cargo binary

Cargo and crates.io have been specifically designed to be reliably reproducible, and had a chance to learn from npm's mistakes to not repeat them. Cargo binary projects have Cargo.lock by default with checksums of all dependencies used. crates.io doesn't allow changing past releases, and has a policy of not deleting any crates unless legally required (user-accesible "yank" hides, but doesn't delete). Crates.io index is a git repository with full history of all changes to the registry, so you can recreate its state at any point in time (in case you lost your Cargo.lock, you can reliably remake one from the past). And on top of that there's `cargo vendor` command that makes a local offline copy of everything you use, so you can fully archive a Cargo project and rebuild it any time later.