I think pinning a dependency against a version identifier and a digest of a tarball is a great way to ensure reproducibility. You’re controlling which dependen

I think pinning a dependency against a version identifier and a digest of a tarball is a great way to ensure reproducibility. You’re controlling which dependency you’re using very specifically. Reproducibility like this protects against supply chain attacks. This may be a bit contrived, but It could prevent a malicious package maintainer from releasing a modified version of OpenSSL that you depend on without you noticing that change in your dependencies.