Not sure if you need anything as complex as that: just the Python tools recording the hash of the dependency and storing that in the git repo should be enough t

Not sure if you need anything as complex as that: just the Python tools recording the hash of the dependency and storing that in the git repo should be enough to prevent this particular problem. e.g. go.sum contains a hash of the entire source. I believe npm and cargo are similar. This way the user should always get the exact same dependency that I added as a developer, no matter what happens with their settings or connection or whatnot. Not familiar with Python's ecosystem at all, but judging from this commit[1] it doesn't seem to have anything it(?) [1]: https://github.com/pytorch/pytorch/commit/bc92444b34dfbe38419a1c8dbea9a7fc3284abe2 https://github.com/pytorch/pytorch/commit/bc92444b34dfbe3841...