We're talking about software releases. Those have an identifier already: the version number. You can even pin that identifier to a hash over the release tarball

We're talking about software releases. Those have an identifier already: the version number. You can even pin that identifier to a hash over the release tarball, all without even beginning to consider reproducible builds.