> where we provide lockfiles that are individually valid Providing lockfiles is a really interesting idea! That certainly solves the "we need your non-determin

> where we provide lockfiles that are individually valid Providing lockfiles is a really interesting idea! That certainly solves the "we need your non-deterministic build tool to reproduce an exact build that we found" problem. We haven't explored this route yet because a lot of our customers use tools that don't support lockfiles (e.g. Maven - Java in general has a lot of legacy stuff). If you want to build off of our work, our dependency analysis bit is open source: https://github.com/fossas/fossa-cli https://github.com/fossas/fossa-cli