Yes thanks as I read the issue and the code I realized the advice was to patch downstream. I know a lot of folks who build hermetic and reproducible builds for

Yes thanks as I read the issue and the code I realized the advice was to patch downstream. I know a lot of folks who build hermetic and reproducible builds for large amounts of open source code often have to patch downstream, but its fairly rare to see that requirement from such a basic crate/library. Hopefully this resolved at some point, it seems like a pretty aggressive stance to take that puts people who have a hard job (rigorous chain of trust in builds is hard work and done for very good reasons!!) in a harder spot.